p PatchFirst

CVE-2024-48948

CVE-2024-48948

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.

CVSS 4.8 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • node-elliptic Debian:12

    Versions
    • 6.5.4~dfsg-2
    • 6.5.7+dfsg-1
    • 6.6.1+dfsg+~6.4.18-1
    • 6.6.1+dfsg+~6.4.18-2
    • 6.6.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-elliptic Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.6.1+dfsg-1

    Update to 6.6.1+dfsg-1

  • node-elliptic Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.6.1+dfsg-1

    Update to 6.6.1+dfsg-1

  • elliptic npm

    Affected ranges
    • SEMVER: < 6.6.0

    Update to 6.6.0

  • node-elliptic Ubuntu:18.04:LTS

    Versions
    • 6.4.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-elliptic Ubuntu:20.04:LTS

    Versions
    • 6.5.1~dfsg-1
    • 6.5.1~dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-elliptic Ubuntu:22.04:LTS

    Versions
    • 6.5.4~dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-elliptic Ubuntu:24.04:LTS

    Versions
    • 6.5.4~dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-elliptic Ubuntu:25.10

    Versions
    • 6.6.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-elliptic Ubuntu:26.10

    Versions
    • 6.6.1+dfsg+~6.4.18-1
    • 6.6.1+dfsg+~6.4.18-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-elliptic Ubuntu:26.04:LTS

    Versions
    • 6.6.1+dfsg-1
    • 6.6.1+dfsg+~6.4.18-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →