Private Key Extraction

tiny-secp256k1 is vulnerable to private key extraction. The vulnerability is due to the ability to bypass Buffer.isBuffer checks when the global Buffer is overridden by the NPM buffer package, which allows an attacker to reuse the nonce k across different messages and extract the private key by...

PT-2025-27492 · Unknown · Tiny-Secp256K1

Name of the Vulnerable Software and Affected Versions: tiny-secp256k1 versions prior to 1.1.7 Description: A private key can be extracted when signing a malicious JSON-stringifiable object, affecting environments where the global Buffer is the buffer package. The Buffer.isBuffer check can be...

Public Key Validation

secp256k1 is vulnerable to public key validation issues. The vulnerability is due to an implementation oversight in the secp256k1-node library, where the loadCompressedPublicKey function fails to verify if the public key is on the secp256k1 curve, allowing the use of invalid public keys from...