CVE-2020-28498: Cryptographic Issues in elliptic Package
Summary
CVE-2020-28498: Elliptic Uses a Broken or Risky Cryptographic Algorithm. Affects elliptic versions < 6.5.4. Fixed in 6.5.4. How to fix ↓
Also tracked for
- node-elliptic · Debian:11
The same CVE-2020-28498 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elliptic package is an npm package that provides an implementation of elliptic curve cryptography. It is commonly used for generating and manipulating cryptographic keys. The package supports various elliptic curves, including secp256k1. This vulnerability specifically affects versions of the elliptic package prior to 6.5.4.
Vulnerability Detail
The vulnerability in the elliptic package arises from the secp256k1 implementation in the elliptic/ec/key.js file. The issue stems from a lack of validation to confirm that the public key point used in the derive function actually exists on the secp256k1 curve. As a result, after a series of ECDH (Elliptic Curve Diffie-Hellman) operations, the private key used in the implementation can be exposed. This vulnerability has a CVSS score of 6.8, indicating a moderate severity level.
How To Fix
Latest published version: 6.6.1 as of 22 Oct 2026
npm install elliptic@6.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.5.4
This is the first release that contains the fix.
npm install elliptic@6.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed version of the elliptic package is the recommended solution.
Conclusion
The elliptic package prior to version 6.5.4 is vulnerable to a cryptographic issue that can expose the private key used in the secp256k1 implementation. To mitigate this vulnerability, it is crucial to update the package to version 6.5.4 or later. For further assistance and support in vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for elliptic →
FAQ
This vulnerability could potentially expose the private key used in the secp256k1 implementation of the elliptic package. If an attacker can exploit this vulnerability, they may be able to decrypt sensitive information or perform unauthorized actions.
No, only versions prior to 6.5.4 are affected. It is recommended to update to version 6.5.4 or later to mitigate the vulnerability.
There are no known public exploits for this vulnerability at the time of writing. However, it is still important to update to the fixed version to prevent potential future exploits.
Yes, this vulnerability can be exploited remotely if the affected package is used in a server or application accessible over the network.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for elliptic.
