| Package | Affected versions | Patched versions |
|---|---|---|
| elliptic | < 6.5.6 | 6.5.6 |
| elliptic | < 6.5.6 | 6.5.6 |
The Elliptic package 6.5.5 for Node.js for EDDSA implementation does not perform the required check if the signature proof(s) is within the bounds of the order n of the base point of the elliptic curve, leading to signature malleability. Namely, the verify function in lib/elliptic/eddsa/index.js omits sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg() validation.
This vulnerability could have a security-relevant impact if an application relies on the uniqueness of a signature.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free