CVE-2024-49364
1 advisory.
npm/tiny-secp256k1 CVE-2024-49364: high 8.1, EPSS 0.36%
tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment
Action: Upgrade tiny-secp256k1 to 1.1.7 or later.
npm i tiny-secp256k1@1.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.7 | - |
Fixed versions
| 1.1.7 |
Sources
- osv: GHSA-7mc2-6phr-23xc
- nvd: CVE-2024-49364
- https://github.com/bitcoinjs/tiny-secp256k1/security/advisories/GHSA-7mc2-6phr-23xc
- https://github.com/bitcoinjs/tiny-secp256k1/pull/140
- https://github.com/bitcoinjs/tiny-secp256k1
CVE-2024-49364 · published · modified · JSON