Vulnerability Description
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Indutny | Elliptic | 6.5.7 |
Related Weaknesses (CWE)
References
- https://blog.trailofbits.com/2025/11/18/we-found-cryptography-bugs-in-the-ellipt
- https://github.com/indutny/elliptic/issues/321ExploitIssue Tracking
- https://github.com/indutny/elliptic/pull/322ExploitIssue Tracking
- https://security.netapp.com/advisory/ntap-20241220-0004/Third Party Advisory
FAQ
What is CVE-2024-48948?
CVE-2024-48948 is a vulnerability with a CVSS score of 4.8 (MEDIUM). The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the ellipti...
How severe is CVE-2024-48948?
CVE-2024-48948 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-48948?
Check the references section above for vendor advisories and patch information. Affected products include: Indutny Elliptic.