{"cve":"CVE-2024-49365","nvd":{"published":"2025-07-01T03:15:21.327","modified":"2026-06-17T07:59:46.403","status":"Deferred","description":"tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. Buffer.isBuffer check can be bypassed, resulting in strange objects being accepted as a message, and those messages could trick verify() into returning false-positive true values. This issue has been patched in version 1.1.7.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","score":8.1},"cvss_v3":null,"cwes":["CWE-347"],"references":["https://github.com/bitcoinjs/tiny-secp256k1/pull/140","https://github.com/bitcoinjs/tiny-secp256k1/security/advisories/GHSA-5vhg-9xg4-cv9m","https://github.com/bitcoinjs/tiny-secp256k1/security/advisories/GHSA-5vhg-9xg4-cv9m"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:03:23.287444849+00:00"},"epss":{"cve":"CVE-2024-49365","score":0.00247,"percentile":0.16061,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5vhg-9xg4-cv9m","url":"https://osv.dev/vulnerability/GHSA-5vhg-9xg4-cv9m","summary":"tiny-secp256k1 allows for verify() bypass when running in bundled environment","modified":"2025-07-01T13:13:38Z","packages":[{"ecosystem":"npm","name":"tiny-secp256k1","purl":"pkg:npm/tiny-secp256k1","ranges":["<1.1.7"],"fixed":["1.1.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}