CVE-2024-48930

secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In "elliptic"-based version, "loadUncompressedPublicKey" has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, "loadCompressedPublicKey" is missing...

CVE-2024-48930: Improper Validation of Integrity Check Value

secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In elliptic-based version, loadUncompressedPublicKey has a check that the public key is on the curve. Prior to versions 5.0.1, 4.0.4, and 3.8.1, however, loadCompressedPublicKey is missing that...

secp256k1-node security vulnerabilities

secp256k1-node is an open source library from cryptocoinjs. A security vulnerability exists in secp256k1-node, which stems from a lack of checking in loadCompressedPublicKey, allowing an attacker to recover the private key. The affected versions are as follows: version 5.0.0, version 4.0.3, versi...