CVE-2024-49365
High
Description
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. Buffer.isBuffer check can be bypassed, resulting in strange objects being accepted as a message, and those messages could trick verify() into returning false-positive true values. This issue has been patched in version 1.1.7.
SeverityHigh
CVSS8.1
Exploit probability—
ProductTiny-secp256k1
PublishedJul 1, 2025
First seenJul 1, 2025
Weakness typeCWE-347CWE-347
How to fix
Update
- tiny-secp256k11.1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tiny-secp256k1npm | v < 1.1.7 | 1.1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.