Vulnerability · Published Jul 1, 2025 · Assigned by GitHub_M

CVE-2024-49365tiny-secp256k1 allows for verify() bypass when running in bundled environment

High 8.1

In plain English

A high-severity security flaw in tiny-secp256k1 from bitcoinjs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.1High

Exploit odds (30 days)0.2%top 83.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. Buffer.isBuffer check can be bypassed, resulting in strange objects being accepted as a message, and those messages could trick verify() into returning false-positive true values. This issue has been patched in version 1.1.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	tiny-secp256k1	1.1.7	GHSA-5vhg-9xg4-cv9m

Affected products (as reported)

Vendor	Product	Versions
bitcoinjs	tiny-secp256k1	< 1.1.7

Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/bitcoinjs/tiny-secp256k1/security/advisories/GHSA-5vhg-9xg4-cv9m x_refsource_CONFIRM
https://github.com/bitcoinjs/tiny-secp256k1/pull/140 x_refsource_MISC