tiny-secp256k1 allows for verify() bypass when running in bundled environment
- Severity:
- High
Description
A malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is buffer package
Recommendation
Update the tiny-secp256k1 package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.1.6
- Patched version(s): 1.1.7
References
Related Issues
- tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364
- Astro's server source code is exposed to the public if sourcemaps are enabled - CVE-2024-56159
- google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability - CVE-2023-48711
- Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) - CVE-2025-27597
- Tags:
- npm
- tiny-secp256k1
Anything's wrong? Let us know Last updated on July 01, 2025