The vulnerability of the _truncateToN function in the Elliptic cryptographic library of the Node.js software platform allows a hacker to execute arbitrary code.

🗓️ 25 Nov 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Elliptic library truncateToN vulnerability allows remote code execution via improper signature verification.

Reporter	Title	Published	Views	Family All 70
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote attacker (CVE-2024-48948)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Product Hub is affected by several vulnerabilities	11 Dec 202422:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	27 Feb 202513:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Elliptic package 6.5.7 for Node.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	21 May 202514:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote attacker (CVE-2024-48948)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile (iOS) is affected by multiple vulnerabilities	2 Mar 202501:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Dashboards that use COS S3 storage are vulnerable to denial of service and security restrictions bypass [CVE-2024-48948] [CVE-2024-48949]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Manage Component uses elliptic-6.5.4.tgz (Publicly disclosed vulnerability found by Mend)	3 Jun 202510:33	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI and/or system health monitoring are now fixed in 5.2.3.7 or higher and 6.0.0.2 or higher	2 Apr 202622:00	–	ibm

Source	Link
github	www.github.com/indutny/elliptic/pull/322
web	www.web.nvd.nist.gov/view/vuln/detail

25 Nov 2025 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 24

CVSS 34.8

EPSS0.00553

elliptic library truncate to n signature verification remote execution arbitrary code execution