@0xcurvy/curvy-sdk (0.0.8-rc.1), @acyclic/keythereum (>=1.1.0, <=1.1.2) +450 more potentially affected by CVE-2026-4258 via sjcl (>=1.0.0, <=1.0.8)

sjcl NPM version =1.0.0, =1.1.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.1.5, =9.0.7, =9.0.7, =1.0.1, =0.0.1, =0.1.0, =1.2.0 and more Source cves: CVE-2026-4258 Source advisory: OSV:GHSA-2W8X-224X-785M...

GHSA-2W8X-224X-785M sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey

All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The...

@0xcurvy/curvy-sdk (0.0.8-rc.1), @acyclic/keythereum (>=1.1.0, <=1.1.2) +450 more potentially affected by CVE-2026-4258 via sjcl (>=1.0.0, <=1.0.8)

sjcl NPM version =1.0.0, =1.1.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.1.5, =9.0.7, =9.0.7, =1.0.1, =0.0.1, =0.1.0, =1.2.0 and more Source cves: CVE-2026-4258 Source advisory: GHSA-2W8X-224X-785M...

@0xcurvy/curvy-sdk (0.0.8-rc.1), @acyclic/keythereum (>=1.1.0, <=1.1.2) +450 more potentially affected by CVE-2026-4258 via sjcl (>=1.0.0, <=1.0.8)

sjcl NPM version =1.0.0, =1.1.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.1.5, =9.0.7, =9.0.7, =1.0.1, =0.0.1, =0.1.0, =1.2.0 and more Source cves: CVE-2026-4258 Source advisory: MEND:CVE-2026-4258...

CVE-2026-4258

Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...

sjcl security vulnerabilities

sjcl is a deprecated JavaScript encryption library developed by bitwiseshiftleft. Sjcl has a security vulnerability, which stems from the lack of point-to-point verification in sjcl.ecc.basicKey.publicKey. This vulnerability could allow attackers to recover the victim’s ECDH private key by sendin...

CVE-2026-4258: Improper Verification of Cryptographic Signature

Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH...

PT-2026-25873

Name of the Vulnerable Software and Affected Versions sjcl affected versions not specified Description The software is susceptible to an Improper Verification of Cryptographic Signature issue due to missing point-on-curve validation within the sjcl.ecc.basicKey.publicKey function. An attacker can...

Improper Verification of Cryptographic Signature

Overview org.webjars.npm:sjcl is a Stanford Javascript Crypto Library Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey. An attacker can recover a victim's ECDH private key b...

org.webjars.npm:github-com-aws-amazon-cognito-identity-js (1.12.0) potentially affected by CVE-2026-4258 via org.webjars.npm:sjcl (1.0.8)

org.webjars.npm:sjcl MAVEN version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sjcl and may be impacted: - org.webjars.npm:github-com-aws-amazon-cognito-identity-js 1.12.0 Source cves: CVE-2026-4258 Source advisory:...

@0xcurvy/curvy-sdk (0.0.8-rc.1), @acyclic/keythereum (>=1.1.0, <=1.1.2) +450 more potentially affected by CVE-2026-4258 via sjcl (>=1.0.0, <=1.0.8)

sjcl NPM version =1.0.0, =1.1.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.1.5, =9.0.7, =9.0.7, =1.0.1, =0.0.1, =0.1.0, =1.2.0 and more Source cves: CVE-2026-4258 Source advisory: SNYK:JS-SJCL-15369617...

Malware in sjcl-extended

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-6138 Malicious code in sjcl-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f14284fb077f3168fbd76a2546bb17a5f2c10f18b712b568fa214a4282d50e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sjcl-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f14284fb077f3168fbd76a2546bb17a5f2c10f18b712b568fa214a4282d50e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...