CVE-2024-48948: Vulnerability in Elliptic Package Leading to Invalid ECDSA Signature Rejections
Summary
CVE-2024-48948: Valid ECDSA signatures erroneously rejected in Elliptic. Affects elliptic versions < 6.6.0. Fixed in 6.6.0. How to fix ↓
Also tracked for
- node-elliptic · Debian:11
The same CVE-2024-48948 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Elliptic package is a widely used library in Node.js for implementing elliptic curve cryptography. It provides functionalities for various cryptographic operations, including digital signatures and key generation. The package is known for its efficiency and ease of use, making it a popular choice among developers for secure communications. However, a vulnerability has been identified in version 6.5.7 that affects the ECDSA signature verification process, potentially leading to legitimate signatures being incorrectly flagged as invalid.
Vulnerability Detail
The vulnerability arises from an anomaly in the ECDSA implementation of the Elliptic package, specifically related to the handling of hashes with at least four leading zero bytes. When the order of the elliptic curve's base point is smaller than the hash, valid ECDSA signatures may be erroneously rejected due to the _truncateToN function. This flaw can have significant ramifications, as it may prevent legitimate transactions or communications from being recognized as valid, leading to disruptions in services that rely on this cryptographic verification.
How To Fix
Latest published version: 6.6.1 as of 22 Oct 2026
npm install elliptic@6.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.6.0
This is the first release that contains the fix.
npm install elliptic@6.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if you cannot update the package immediately, you can implement additional checks in your application to validate ECDSA signatures before relying on the Elliptic package for verification. However, this is not a long-term solution and updating the package is strongly recommended.
Conclusion
The vulnerability identified as CVE-2024-48948 in the Elliptic package poses a significant risk by causing valid ECDSA signatures to be incorrectly rejected. It is crucial for developers using this package to update to the patched version to ensure the integrity of their cryptographic operations and avoid potential disruptions in their applications.
See every vulnerability recorded for elliptic →
FAQ
CVE-2024-48948 is a vulnerability in the Elliptic package that causes valid ECDSA signatures to be incorrectly rejected under certain conditions.
The vulnerability affects Elliptic package versions from 0.0.0 up to and including 6.5.7.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
The main impact is that legitimate ECDSA signatures may be rejected, leading to failed transactions or communications, which can disrupt services relying on this cryptographic verification.
If an immediate update is not possible, consider implementing additional validation checks for ECDSA signatures in your application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for elliptic.
