CVE-2021-32685: Improper Verification of Cryptographic Signature in tEnvoy
Summary
CVE-2021-32685: Improper Verification of Cryptographic Signature. Affects tenvoy versions < 7.0.3. Fixed in 7.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tEnvoy is a library used in node.js and the browser for cryptographic operations such as hashing, random number generation, encryption, decryption, signatures, and conversions. It is utilized by TogaTech.org. The library includes PGP, NaCl, and PBKDF2 functionalities. However, versions prior to 7.0.3 of tEnvoy contain a vulnerability that allows for improper verification of cryptographic signatures.
Vulnerability Detail
The verifyWithMessage method of tEnvoyNaClSigningKey in tEnvoy versions prior to 7.0.3 always returns true for any signature that has a SHA-512 hash matching the SHA-512 hash of the message, even if the signature is invalid. This means that an attacker can forge a signature and it will still be considered valid. The impact of this vulnerability is critical as it undermines the integrity and authenticity of cryptographic signatures, potentially leading to unauthorized access, data tampering, and other security breaches.
How To Fix
Latest published version: 7.0.7 as of 23 Oct 2026
npm install tenvoy@7.0.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3
This is the first release that contains the fix.
npm install tenvoy@7.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can modify the verifyWithMessage method in tenvoy.js within the tEnvoyNaClSigningKey class. The return statement call to this.verify should end with .verified. This modification ensures that the method only returns true for valid signatures. However, it is strongly advised to apply the official patch by updating to tEnvoy version 7.0.3 or later.
Conclusion
The vulnerability in tEnvoy versions prior to 7.0.3 allows for improper verification of cryptographic signatures, potentially leading to unauthorized access and data tampering. It is crucial to update tEnvoy to version 7.0.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tenvoy →
FAQ
tEnvoy is a library used for cryptographic operations in node.js and the browser. It provides functionalities such as hashing, random number generation, encryption, decryption, signatures, and conversions.
The vulnerability allows for improper verification of cryptographic signatures, which undermines their integrity and authenticity. This can lead to unauthorized access, data tampering, and other security breaches.
To fix this vulnerability, update tEnvoy to version 7.0.3 or later. This version includes a patch that addresses the improper verification of cryptographic signatures.
Yes, a temporary workaround involves modifying the verifyWithMessage method in tenvoy.js within the tEnvoyNaClSigningKey class. The return statement call to this.verify should end with .verified.
For more information about this vulnerability, you can refer to the GitHub Security Advisory database or contact the developers of tEnvoy.
References
Related vulnerabilities
Recent vulnerabilities recorded for tenvoy.
