CVE-2024-49365: tiny-secp256k1 Verify Bypass Vulnerability in Bundled Environments
Summary
CVE-2024-49365: tiny-secp256k1 allows for verify() bypass when running in bundled environment. Affects tiny-secp256k1 versions < 1.1.7. Fixed in 1.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tiny-secp256k1 is a JavaScript library that provides elliptic curve cryptography functionalities, specifically for the secp256k1 curve used in Bitcoin and other cryptocurrencies. It allows developers to perform operations such as signing and verifying messages. However, this library has a vulnerability that can lead to incorrect verification of signatures when used in certain bundled environments, such as browser applications or React Native apps.
Vulnerability Detail
The vulnerability arises from a bypass in the Buffer.isBuffer check, which can be exploited in environments where the global Buffer is sourced from the 'buffer' package. This allows maliciously crafted JSON-stringifyable messages to be accepted as valid inputs for the verify() function, potentially leading to false-positive verifications. This issue is particularly concerning as it can allow attackers to create messages that appear valid when they are not, undermining the integrity of the cryptographic operations performed by the library.
How To Fix
Latest published version: 2.2.4 as of 22 Oct 2026
npm install tiny-secp256k1@2.2.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.7
This is the first release that contains the fix.
npm install tiny-secp256k1@1.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks to ensure that the data being processed is indeed a valid Uint8Array before passing it to the verify function. Here is a sample code snippet to illustrate this:
function verified(data, signature) {
if (!Buffer.isBuffer(data)) data = Buffer.from(data, 'hex');
if (!tiny.verify(data, publicKey, signature)) throw new Error('Signature invalid!');
return new Uint8Array(data);
}
Conclusion
The tiny-secp256k1 library has a significant vulnerability that can lead to incorrect signature verifications in certain environments. It is crucial for developers to update to the latest version to mitigate this risk and ensure the integrity of cryptographic operations. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for tiny-secp256k1 →
FAQ
The vulnerability allows for a bypass of the verify() function, enabling malicious messages to be accepted as valid signatures in certain environments.
Developers using tiny-secp256k1 in bundled environments, such as web applications or React Native apps, are at risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Update the tiny-secp256k1 package to version 1.1.7 or later to ensure that the vulnerability is patched.
Implement additional validation checks on the data being processed before using the verify function as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for tiny-secp256k1.
