-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies the verify function in lib/elliptic/eddsa/index.js as missing critical signature validation checks (sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()). The GitHub commit diff shows these exact checks were added to the verify function in the patch. The CWE-347 (Improper Verification of Cryptographic Signature) directly maps to this missing validation. The combination of vulnerability reports, CWE mapping, and patch confirmation provides high confidence in this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| elliptic | npm | < 6.5.6 | 6.5.6 |
JavaScriptJavaScript