tiny-secp256k1 vulnerabilities

2 known vulnerabilities in tiny-secp256k1 from Bitcoinjs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  tiny-secp256k1: Improper Verification of Cryptographic Signature

  CVE-2024-49365Jul 1, 2025Bitcoinjs

  tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM bu

• 8.1 High severity

  tiny-secp256k1: Insufficiently Protected Credentials

  CVE-2024-49364Jul 1, 2025Bitcoinjs

  tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require('buffer') is t