Elliptic JavaScript Library Hit by Critical Cryptography Flaws

Two significant cryptographic vulnerabilities were disclosed in the widely used elliptic JavaScript library, downloaded more than 10 million times weekly. These weaknesses affect EdDSA and ECDSA implementations, enabling signature forgery or causing valid signatures to fail verification. MITRE ATT&CK relevance includes T1600 (Weaken Cryptography) and T1587 (Develop Capabilities). One vulnerability, CVE-2024-48949, stems from a missing bounds check in the EdDSA signature validator, allowing attackers to forge signatures for known message-signature pairs. The second, CVE-2024-48948, affects ECDSA verification due to incorrect handling of hashes with leading zeros, causing valid signatures to be rejected. The issues were uncovered through Wycheproof test vectors developed by Trail of Bits. Three additional parsing-related findings were also assigned CVE identifiers, though these are considered minor. Notably, one of the major vulnerabilities remains unpatched despite the expiration of the 90-day disclosure window. The risk is amplified by the widespread use of elliptic across nearly 3,000 projects, including cryptographic libraries, blockchain systems, authentication flows, and secure messaging tools. The business impact includes potential signature forgery, degraded trust in cryptographic operations, blockchain consensus disruption, and regulatory exposure for systems relying on elliptic-based signature verification. Threat actors could exploit these flaws to bypass authentication, manipulate transactions, or cause denial-of-service in systems dependent on correct signature verification. Mitigation requires immediate codebase review for implementations that import elliptic, applying patches where available, and migrating to verified crypto libraries. Developers should integrate Wycheproof or similar vector suites into CI/CD pipelines to identify regressions early. Organizations should inventory cryptographic dependencies and prepare staged rollouts to validate compatibility and correctness.