Private Key Extraction

tiny-secp256k1 is vulnerable to private key extraction. The vulnerability is due to the ability to bypass Buffer.isBuffer checks when the global Buffer is overridden by the NPM buffer package, which allows an attacker to reuse the nonce k across different messages and extract the private key by...

PT-2025-27492 · Unknown · Tiny-Secp256K1

Name of the Vulnerable Software and Affected Versions: tiny-secp256k1 versions prior to 1.1.7 Description: A private key can be extracted when signing a malicious JSON-stringifiable object, affecting environments where the global Buffer is the buffer package. The Buffer.isBuffer check can be...

Public Key Validation

secp256k1 is vulnerable to public key validation issues. The vulnerability is due to an implementation oversight in the secp256k1-node library, where the loadCompressedPublicKey function fails to verify if the public key is on the secp256k1 curve, allowing the use of invalid public keys from...

@0xvitto/context (>=0.1.0 <=0.1.1), @1001-digital/components.evm (>=1.3.0 <=3.6.11) +699 more potentially affected by CVE-2024-48930 via secp256k1 (=5.0.0)

secp256k1 NPM version =5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on secp256k1 and may be impacted: - @0xvitto/context =0.1.0, =1.3.0, =0.1.0, =1.2.2, =0.0.3, =0.1.0, =0.1.0, =0.1.0, =0.1.3, =2.2.2, =0.0.1, =0.0.4 and more Source cves:...

@0day-network/mod-renderer (>=0.1.0 <=0.1.1), @0day-network/react-sdk (>=0.0.1 <=0.2.1) +792 more potentially affected by CVE-2024-48930 via secp256k1 (>=4.0.0 <=4.0.3)

secp256k1 NPM version =4.0.0, =0.1.0, =0.0.1, =1.0.21, =1.0.6, =1.0.2, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.4.1 - @aloe2/abstract-eth =1.0.20228282226 - @aloe2/account-lib =2.20.20228282226 - @aloe2/bitgo =14.2.20228282226 - @aloe2/sdk-coin-avaxc =1.1.20228282226 - @aloe2/sdk-coin-bsc...