Signature Malleabillity in elliptic

Description

The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading ‘\0’ bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Recommendation

Update the elliptic package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.5.3
• Patched version(s): 6.5.3

References

• GHSA-vh7m-p724-62c2
• medium.com
• www.npmjs.com
• yondon.blog
• CVE-2020-13822
• CWE-190
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Valid ECDSA signatures erroneously rejected in Elliptic - CVE-2024-48948
• Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) - Vulnerability
• @rpldy/uploader prototype pollution - CVE-2024-57082
• DocsGPT Allows Remote Code Execution - CVE-2025-0868

Tags:

npm

elliptic