Description
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
Recommendation
Update the @lionello/secp256k1-js package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.1.0
- Patched version(s): 1.1.0
References
Could your website be exposed too?
SmartScanner can check your website for secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Leading white space bypasses protocol validation - CVE-2022-24723
- JWS and JWT signature validation vulnerability with special characters - CVE-2022-25898
- ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign - CVE-2020-14966
- Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser - CVE-2026-47430
You might also like:
See something that needs correcting? Let us knowUpdated January 28, 2023