npm/tiny-secp256k1 CVE-2024-49365: high 8.1, EPSS 0.25%
tiny-secp256k1 allows for verify() bypass when running in bundled environment
Action: Upgrade tiny-secp256k1 to 1.1.7 or later.
npm i tiny-secp256k1@1.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.7 | - |
Fixed versions
| 1.1.7 |
Sources
- osv: GHSA-5vhg-9xg4-cv9m
- nvd: CVE-2024-49365
- https://github.com/bitcoinjs/tiny-secp256k1/security/advisories/GHSA-5vhg-9xg4-cv9m
- https://github.com/bitcoinjs/tiny-secp256k1/pull/140
- https://github.com/bitcoinjs/tiny-secp256k1
CVE-2024-49365 · published · modified · JSON