GHSA-848j-6mx2-7j84
Medium · 5.6CVSS
5.6
EPSS
—
Published
Jan 8, 2026
CISA due date
—
The record
Elliptic Uses a Cryptographic Primitive with a Risky Implementation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | elliptic | 0 | No fix |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r0 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
Related vulnerabilities
- CVE-2025-14505 The ECDSA implementation of the Elliptic package generates incorrect signatures if an… Same vulnerability
- GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) Also affects elliptic
- CVE-2024-48948 The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not… Also affects elliptic
- CVE-2024-48949 The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6… Also affects elliptic
- CVE-2024-42460 In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because… Also affects elliptic
- CVE-2024-42459 In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because… Also affects elliptic
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects opensearch-dashboards-3
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects opensearch-dashboards-3