CVE-2019-9155: Invalid Curve Attack in openpgp
Summary
CVE-2019-9155: Invalid Curve Attack in openpgp. Affects openpgp versions < 4.3.0. Fixed in 4.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The openpgp package is an open-source library for encryption and decryption using the OpenPGP protocol. It provides functionality for key generation, encryption, decryption, signing, and verification of OpenPGP messages. The package is widely used in various applications for secure communication and data protection. However, versions prior to 4.3.0 are vulnerable to an Invalid Curve Attack.
Vulnerability Detail
The vulnerability in openpgp arises from its implementation of Elliptic Curve Diffie-Hellman (ECDH) key exchange. The package fails to properly verify the validity of the communication partner's public key, allowing attackers to manipulate the curve used for key generation. By choosing an altered curve, attackers can exfiltrate the victim's private key. This attack requires the attacker to initiate message decryption and record the result, while the victim's key must offer an ECDH public key. The consequences of a successful attack can lead to the compromise of sensitive information and unauthorized access to encrypted data.
How To Fix
Latest published version: 6.3.2 as of 23 Oct 2026
npm install openpgp@6.3.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.0
This is the first release that contains the fix.
npm install openpgp@4.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The openpgp package prior to version 4.3.0 is vulnerable to an Invalid Curve Attack, which can lead to the compromise of sensitive information and unauthorized access to encrypted data. It is crucial to upgrade to the fixed version or apply the recommended fixes to ensure the security of your application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openpgp →
FAQ
The openpgp package is an open-source library for encryption and decryption using the OpenPGP protocol. It provides functionality for key generation, encryption, decryption, signing, and verification of OpenPGP messages.
An Invalid Curve Attack is a cryptographic attack where an attacker manipulates the elliptic curve used in a key exchange protocol to compromise the security of the communication and potentially extract sensitive information.
To exploit this vulnerability, an attacker needs to be able to initiate message decryption and record the result. Additionally, the victim's key must offer an ECDH public key. By choosing an altered curve, the attacker can exfiltrate the victim's private key.
The consequences of a successful attack exploiting this vulnerability can include the compromise of sensitive information, unauthorized access to encrypted data, and potential unauthorized use of the victim's private key.
To fix this vulnerability, it is recommended to upgrade to version 4.3.0 or later of the openpgp package. If you are currently using a version prior to 4.0.0, it is highly recommended to review the High-Level API Changes section of the openpgp 4.0.0 release notes for any additional considerations or modifications required during the upgrade process.
References
Related vulnerabilities
Recent vulnerabilities recorded for openpgp.
