-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing validation in the ECDH key derivation process. The commit diff shows the vulnerability was fixed by adding 'pub.validate()' check in KeyPair.prototype.derive. The advisory explicitly references this function as the vulnerable location, and the added test case demonstrates how invalid public points could be passed to derive without validation in vulnerable versions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| elliptic | npm | < 6.5.4 | 6.5.4 |