← All advisories

High severityNVD Advisory· Published Sep 24, 2022· Updated May 22, 2025

CVE-2022-41340

CVE-2022-41340

Description

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@lionello/secp256k1-jsnpm	< 1.1.0	1.1.0

Affected products

2

secp256k1-js/secp256k1-jsdescription
ghsa-coords
pkg:npm/%40lionello/secp256k1-js
Range: < 1.1.0

Patches

Vulnerability mechanics

References

7

github.com/advisories/GHSA-q3f4-9h4p-vgr3ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-41340ghsaADVISORY
github.com/lionello/secp256k1-js/commit/302800f0370b42e360a33774bb808274ac729c2eghsax_refsource_MISCWEB
github.com/lionello/secp256k1-js/compare/1.0.1...1.1.0ghsax_refsource_MISCWEB
github.com/lionello/secp256k1-js/issues/11ghsax_refsource_MISCWEB
www.npmjs.com/package/%40lionello/secp256k1-jsmitrex_refsource_MISC
www.npmjs.com/package/@lionello/secp256k1-jsghsaWEB

News mentions

0

No linked articles in our index yet.