npm/elliptic: critical
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
Action: Upgrade elliptic to 6.6.1 or later.
npm i elliptic@6.6.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.6.1 | - |
Fixed versions
| 6.6.1 |
Sources
- osv: GHSA-vjh7-7g9h-fjfh
- https://github.com/indutny/elliptic/security/advisories/GHSA-vjh7-7g9h-fjfh
- https://github.com/indutny/elliptic/commit/04cb6f54ce552b3ebde6be06d6050419e1c7333e
- https://github.com/indutny/elliptic
published · modified · JSON