Improper Verification of Cryptographic Signature in tEnvoy
Summary
GHSA-7r96-8g3x-g36m: Improper Verification of Cryptographic Signature. Affects tenvoy versions < 7.0.3. Fixed in 7.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tEnvoy is an open-source package available on the npm ecosystem. It provides cryptographic signing and verification functionality using the NaCl library. The package allows users to sign messages with a private key and verify the signatures with a corresponding public key. However, a vulnerability has been discovered in the verifyWithMessage method of the tEnvoyNaClSigningKey class. This method incorrectly verifies the cryptographic signature, leading to potential security issues.
Vulnerability Detail
The verifyWithMessage method in tEnvoy always returns true for any signature of a SHA-512 hash matching the SHA-512 hash of the message, even if the signature is invalid. This means that an attacker can forge a signature and the verification process will still consider it valid. The impact of this vulnerability is critical as it undermines the integrity and authenticity of the cryptographic signatures. An attacker could potentially impersonate a legitimate user or tamper with the signed data without detection.
How To Fix
Latest published version: 7.0.7 as of 23 Oct 2026
npm install tenvoy@7.0.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3
This is the first release that contains the fix.
npm install tenvoy@7.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be applied. In the tenvoy.js file, locate the verifyWithMessage method definition within the tEnvoyNaClSigningKey class. Modify the return statement to ensure that the call to this.verify ends with .verified. For example, change return this.verify(signed, password) && to return this.verify(signed, password).verified && . This modification ensures that the verification process properly checks the validity of the signature.
Conclusion
In conclusion, the tEnvoy package is vulnerable to an improper verification of cryptographic signatures. Upgrading to version 7.0.3 or applying the provided workaround is crucial to mitigate the risk associated with this vulnerability. Reverification of previously verified signatures is highly recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tenvoy →
FAQ
The impact of this vulnerability is critical as it allows an attacker to forge valid signatures, undermining the integrity and authenticity of the cryptographic signatures. This can lead to impersonation of legitimate users or tampering with signed data without detection.
To fix this vulnerability, it is recommended to upgrade to version 7.0.3 of the tEnvoy package. This version includes a patch that addresses the improper verification issue. Reverification of previously verified signatures is also recommended.
Yes, previous signatures verified with the vulnerable verifyWithMessage method are still considered valid. However, to ensure the integrity of the signatures, it is highly recommended to reverify them using the updated method after upgrading to version 7.0.3.
Yes, if upgrading to the latest version is not immediately feasible, a temporary workaround can be applied. It involves modifying the verifyWithMessage method in the tenvoy.js file to ensure proper verification of the signature.
For more information, you can open an issue in the GitHub repository of tEnvoy: https://github.com/TogaTech/tEnvoy
References
Related vulnerabilities
Recent vulnerabilities recorded for tenvoy.
