Description
All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim’s ECDH private key by sending crafted off-curve public keys and observing ECDH outputs.
Recommendation
Update the sjcl package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.8
- Patched version(s): 1.0.9
References
Could your website be exposed too?
SmartScanner can check your website for sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction - CVE-2026-4601
- locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor - CVE-2026-41886
- uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - CVE-2026-41907
- StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check - CVE-2026-32101
You might also like:
See something that needs correcting? Let us knowUpdated March 25, 2026