tiny-secp256k1 allows for verify() bypass when running in bundled environment

Description

A malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is buffer package

Recommendation

Update the tiny-secp256k1 package to the latest compatible version. Followings are version details:

Affected version(s): <= 1.1.6
Patched version(s): 1.1.7

References

GHSA-5vhg-9xg4-cv9m
CVE-2024-49365
CWE-347
CAPEC-310
OWASP 2021-A2
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for tiny-secp256k1 allows for verify() bypass when running in bundled environment and gives you actionable findings to investigate.

Start a free scan

Related Issues

tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364
secp256k1-node allows private key extraction over ECDH - CVE-2024-48930
AngularJS allows attackers to bypass common image source restrictions - CVE-2024-8372
AngularJS allows attackers to bypass common image source restrictions - angular - CVE-2024-8373

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated July 01, 2025