CVSS 3.1
7.7 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:LCVE-2020-13822
High (7.7) in indutny elliptic. EPSS 2.7% chance of exploitation in the next 30 days. Fixed in elliptic 6.5.3.
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Severity
- EPSS
- 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-190
- Published
- Modified
- Record from
- the NVD, synced
Affected
- indutny:elliptic
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vh7m-p724-62c2 | npm | elliptic | <6.5.3 | 6.5.3 |