GHSA-q3f4-9h4p-vgr3HighCVSS 7.5

secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery

Published
September 25, 2022
Last Modified
January 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-41340 →

📋 Description

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.

🎯 Affected products1

  • npm/@lionello/secp256k1-js:< 1.1.0

🔗 References (6)