CVE-2024-49365

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-49365

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49365.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-49365

Aliases

GHSA-5vhg-9xg4-cv9m

Published

2025-07-01T02:07:02.922Z

Modified

2026-08-12T03:51:08.760915359Z

Severity

8.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

tiny-secp256k1 allows for verify() bypass when running in bundled environment

Details

tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. Buffer.isBuffer check can be bypassed, resulting in strange objects being accepted as a message, and those messages could trick verify() into returning false-positive true values. This issue has been patched in version 1.1.7.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49365.json",
    "cwe_ids": [
        "CWE-347"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/bitcoinjs/tiny-secp256k1

Affected ranges

Type

GIT

Repo

https://github.com/bitcoinjs/tiny-secp256k1

Events

Introduced

Fixed

fc53db79af6e2738661ea3dcaf3c4ecb8541a149

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.7"
        }
    ]
}

Affected versions

v0.*

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.0.7

v0.1.0

v0.2.2

v1.*

v1.0.1

v1.1.1

v1.1.2

v1.1.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49365.json"