Dependency elliptic affected by CVE-2025-14505 (ECDSA signature vulnerability) #255
Description
Summary
The elliptic package (a dependency of crypto-browserify) is affected by CVE-2025-14505, causing incorrect ECDSA
signatures and potential private key exposure.
Details
- CVE: CVE-2025-14505
- GHSA: GHSA-848j-6mx2-7j84
- Affected: elliptic ≤ 6.6.1 (all versions)
- Upstream issue: indutny/elliptic#344
Impact
Incorrect signature generation when nonce k has leading zeros, potentially allowing private key recovery if attackers
obtain both faulty and correct signatures.
Status
No patch is available yet. Tracking this issue to update the dependency once elliptic releases a fix.