Vulnerabilities in pkg:npm/elliptic
PACKAGECVE-2025-14505 is a LOW (CVSS 5.6) elliptic uses a cryptographic primitive vulnerability (CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation) affecting Elliptic libraries in the npm ecosystem. The issue involves elliptic uses a cryptographic primitive with a risky implementation. Remediation is available in the latest vendor maintenance releases.
pkg:npm/elliptic
Vulnerability advisories affecting package pkg:npm/elliptic. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-848j-6mx2-7j84 | CVE-2025-14505 | LOW | Elliptic Uses a Cryptographic Primitive with a Risky Implementation |
| GHSA-fc9h-whq2-v747 | CVE-2024-48948 | LOW | Valid ECDSA signatures erroneously rejected in Elliptic |
| GHSA-434g-2637-qmqr | CVE-2024-48949 | LOW | Elliptic's verify function omits uniqueness validation |
| GHSA-49q7-c7j4-3p7m | CVE-2024-42461 | LOW | Elliptic allows BER-encoded signatures |
| GHSA-977x-g7h5-7qgw | CVE-2024-42460 | LOW | Elliptic's ECDSA missing check for whether leading bit of r and s is zero |
| GHSA-f7q4-pwc6-w24p | CVE-2024-42459 | LOW | Elliptic's EDDSA missing signature length check |
| GHSA-vjh7-7g9h-fjfh | - | CRITICAL | Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) |
| GHSA-vh7m-p724-62c2 | CVE-2020-13822 | HIGH | Signature Malleabillity in elliptic |
| GHSA-r9p9-mrjm-926w | CVE-2020-28498 | MODERATE | Elliptic Uses a Broken or Risky Cryptographic Algorithm |
CVE-2025-14505 at a Glance
Security Impact
CVSS: 5.6
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
How to Fix CVE-2025-14505
To remediate this vulnerability, upgrade all affected Elliptic dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install elliptic@Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls ellipticHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-14505, inspect your project dependencies using npm:
npm ls ellipticAnalyze the terminal output to locate any version of Elliptic in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The npm ls elliptic command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation, where to fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation. In Elliptic, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-14505 Affected Elliptic Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
elliptic
|
npm |
≤ 6.6.1
|
|
References
Frequently Asked Questions
What is CVE-2025-14505?
Which Elliptic versions are affected?
What version fixes CVE-2025-14505?
Is elliptic affected?
What is the CVSS score of CVE-2025-14505?
What CWE is associated with CVE-2025-14505?
How can I check npm dependencies for CVE-2025-14505?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-848j-6mx2-7j84",
"modified" : "2026-01-09T20:19:43Z",
"published" : "2026-01-08T21:30:34Z",
"aliases" : [ "CVE-2025-14505" ],
"summary" : "Elliptic Uses a Cryptographic Primitive with a Risky Implementation",
"details" : "The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This happens, because the byte-length of 'k' is incorrectly computed, resulting in its getting truncated during the computation. Legitimate transactions or communications will be broken as a result. Furthermore, due to the nature of the fault, attackers could–under certain conditions–derive the secret key, if they could get their hands on both a faulty signature generated by a vulnerable version of Elliptic and a correct signature for the same inputs.\n\nThis issue affects all known versions of Elliptic (at the time of writing, versions less than or equal to 6.6.1).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "elliptic"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "6.6.1"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-14505"
}, {
"type" : "WEB",
"url" : "https://github.com/indutny/elliptic/issues/321"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/indutny/elliptic"
}, {
"type" : "WEB",
"url" : "https://www.herodevs.com/vulnerability-directory/cve-2025-14505"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1240" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-09T20:19:43Z",
"nvd_published_at" : "2026-01-08T21:15:42Z"
}
}