{"action":"Upgrade @dfinity/auth-client to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0.20.0-beta.0"}],"component":"@dfinity/auth-client","cve_ids":["CVE-2024-1631"],"ecosystem":"npm","epss":0.00882,"exploited":false,"fixed_versions":["1.0.1"],"ghsa_id":"GHSA-c9vv-fhgv-cjc3","id":"tcs_01M5KFJAST2P2FPTCMX004EV9F","modified_at":"2026-07-08T06:53:06.618098144Z","published_at":"2024-02-21T02:54:56Z","references":["https://osv.dev/vulnerability/GHSA-c9vv-fhgv-cjc3","https://github.com/dfinity/agent-js/security/advisories/GHSA-c9vv-fhgv-cjc3","https://nvd.nist.gov/vuln/detail/CVE-2024-1631","https://github.com/dfinity/agent-js/pull/851","https://agent-js.icp.xyz/identity/index.html","https://github.com/dfinity/agent-js","https://www.npmjs.com/package/@dfinity/identity/v/1.0.1"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-c9vv-fhgv-cjc3#npm/@dfinity/auth-client","url":"https://osv.dev/vulnerability/GHSA-c9vv-fhgv-cjc3"}],"summary":"agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`"}