sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey

Description

All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim’s ECDH private key by sending crafted off-curve public keys and observing ECDH outputs.

Recommendation

Update the sjcl package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.8
• Patched version(s): 1.0.9

References

• GHSA-2w8x-224x-785m
• security.snyk.io
• CVE-2026-4258
• CWE-325
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction - CVE-2026-4601
• locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor - CVE-2026-41886
• uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - CVE-2026-41907
• StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check - CVE-2026-32101

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

sjcl