PT-2025-27493 · Unknown · Tiny-Secp256K1
Published
2025-06-30
·
Updated
2025-07-16
·
CVE-2024-49365
CVSS v4.0
9.1
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
tiny-secp256k1 versions prior to 1.1.7
Description:
A malicious JSON-stringifyable message can be made to bypass the
Buffer.isBuffer check, resulting in strange objects being accepted as a message. This can trick the verify() function into returning false-positive true values. The issue affects environments where require('buffer') is the NPM buffer package, such as browser bundles and React Native apps. A malicious message can be constructed for any already known message/signature pair, with some restrictions depending on the known message/signature.Recommendations:
For tiny-secp256k1 versions prior to 1.1.7, update to version 1.1.7 or later to resolve the issue. As a temporary workaround, consider adding additional input validation to ensure that only actual
Uint8Array instances are accepted as messages. Restrict access to the verify() function to minimize the risk of exploitation. Avoid using the Buffer.isBuffer check alone to verify the integrity of messages.Exploit
Fix
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tiny-Secp256K1