tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir
- Severity:
- High
Description
Private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is buffer package
Recommendation
Update the tiny-secp256k1 package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.1.6
- Patched version(s): 1.1.7
References
Related Issues
- tiny-secp256k1 allows for verify() bypass when running in bundled environment - CVE-2024-49365
- secp256k1-node allows private key extraction over ECDH - CVE-2024-48930
- jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction - CVE-2026-4601
- Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
You might also like:
- Tags:
- npm
- tiny-secp256k1
Anything's wrong? Let us know Last updated on July 01, 2025