CVE-2025-14505: Elliptic Package Suffers from Risky ECDSA Implementation Leading to Signature Issues
Summary
CVE-2025-14505: Elliptic Uses a Cryptographic Primitive with a Risky Implementation. Affects elliptic versions < 6.6.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Elliptic package is a widely used library in the JavaScript ecosystem, specifically designed for elliptic curve cryptography. It provides functionalities for secure digital signatures, key exchange, and encryption. However, the package has been found to have a critical vulnerability in its ECDSA implementation, which can lead to incorrect signature generation and potential exposure of secret keys.
Vulnerability Detail
The vulnerability arises from the incorrect computation of the byte-length of the 'k' value during the ECDSA signature generation process. According to RFC 6979, if 'k' has leading zeros, it can be truncated, resulting in faulty signatures. This flaw not only breaks legitimate transactions but also exposes the secret key to attackers under certain conditions, particularly if they possess both a faulty signature and a correct signature for the same inputs.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the Elliptic package for ECDSA operations until you can update to a secure version. Consider using alternative libraries that do not have this vulnerability.
Conclusion
The vulnerability in the Elliptic package poses significant risks to applications relying on its ECDSA implementation. It is crucial for developers to update to the latest version to mitigate these risks and ensure the security of their cryptographic operations.
See every vulnerability recorded for elliptic →
FAQ
The CVSS score of this vulnerability is 5.6, indicating a moderate severity level.
All versions of the Elliptic package less than or equal to 6.6.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include the generation of incorrect signatures, broken transactions, and the risk of secret key exposure to attackers.
Yes, a patch is available in versions of the Elliptic package greater than 6.6.1.
Related vulnerabilities
Recent vulnerabilities recorded for elliptic.
