CVE-2024-42461

Elliptic allows BER-encoded signatures

9.1 CriticalPublic exploitFix available

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.62%Up 0.6 points since Aug 6, 2024

What each source reports

NVD Score used 9.1

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: CVE-2024-42461
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-347
Updated: 2026-11-02

CVE List 5.3

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: CVE-2024-42461
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-347
Updated: 2026-11-02

EUVDEUVD-2024-2487 5.3

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: EUVD-2024-2487
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-49q7-c7j4-3p7m 2.7

Elliptic allows BER-encoded signatures

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: GHSA-49q7-c7j4-3p7m
CVSS 4.0: 2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-347
Updated: 2026-11-02

OSVAZL-47425 9.1

CVE-2024-42461 affecting package reaper for versions less than 3.1.1-11

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: AZL-47425
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSV 5.3

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: CVE-2024-42461
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Show 10 moreShow less

OSVDEBIAN-CVE-2024-42461 9.1

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: DEBIAN-CVE-2024-42461
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVGHSA-49q7-c7j4-3p7m 2.7

Elliptic allows BER-encoded signatures

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: GHSA-49q7-c7j4-3p7m
CVSS 4.0: 2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-347
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2024-42461 9.1

CVE-2024-42461 in elliptic - Patched by Root

Root has patched CVE-2024-42461 in the elliptic package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2024-42461
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-06

OSVUBUNTU-CVE-2024-42461 5.3

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

Record: UBUNTU-CVE-2024-42461
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVCLSA-2026-1781139210 No score

TuxCare security update for elliptic (9 CVEs)

TuxCare rebuilt elliptic to address 9 CVEs. Fixed in 6.4.1-tuxcare.1.

Record: CLSA-2026-1781139210
Updated: 2026-11-02

OSVCLSA-2026-1781139211 No score

TuxCare security update for elliptic (7 CVEs)

TuxCare rebuilt elliptic to address 7 CVEs. Fixed in 6.5.4-tuxcare.1.

Record: CLSA-2026-1781139211
Updated: 2026-11-02

OSVCLSA-2026-1781139212 No score

TuxCare security update for elliptic (7 CVEs)

TuxCare rebuilt elliptic to address 7 CVEs. Fixed in 6.5.5-tuxcare.1.

Record: CLSA-2026-1781139212
Updated: 2026-11-02

OSVCLSA-2026-1793101918 No score

TuxCare security update for elliptic (6 CVEs)

TuxCare rebuilt elliptic to address 6 CVEs. Fixed in 6.5.1-tuxcare.2.

Record: CLSA-2026-1793101918
Updated: 2026-11-02

OSVCLSA-2026-1793102023 No score

TuxCare security update for elliptic (5 CVEs)

TuxCare rebuilt elliptic to address 5 CVEs. Fixed in 6.5.3-tuxcare.2.

Record: CLSA-2026-1793102023
Updated: 2026-11-02

OSVopenSUSE-SU-2025:14663-1 No score

velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media

These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:14663-1
Updated: 2026-11-02

Affected products

elliptic project elliptic

Affected packages

Affected packages
Package	Affected	Fixed
`elliptic` npm	5.2.1 to 6.5.6	6.5.7
`reaper` Azure Linux:2	before 3.1.1-11	3.1.1-11
`elliptic` TuxCare:npm From an advisory covering 8 CVEs	6.4.1-tuxcare.0 up to 6.4.1-tuxcare.1, plus listed versions 6.4.1	6.4.1-tuxcare.1
`elliptic` TuxCare:npm From an advisory covering 6 CVEs	6.5.4-tuxcare.0 up to 6.5.4-tuxcare.1, plus listed versions 6.5.4	6.5.4-tuxcare.1
`elliptic` TuxCare:npm From an advisory covering 6 CVEs	6.5.5-tuxcare.0 up to 6.5.5-tuxcare.1, plus listed versions 6.5.5	6.5.5-tuxcare.1
`elliptic` TuxCare:npm From an advisory covering 6 CVEs	6.5.1-tuxcare.0 up to 6.5.1-tuxcare.2, plus listed versions 6.5.16.5.1-tuxcare.1	6.5.1-tuxcare.2
`elliptic` TuxCare:npm From an advisory covering 5 CVEs	6.5.3-tuxcare.0 up to 6.5.3-tuxcare.2, plus listed versions 6.5.36.5.3-tuxcare.1	6.5.3-tuxcare.2
`node-elliptic` Debian:12	All versions, plus listed versions 6.5.4~dfsg-26.5.7+dfsg-16.6.1+dfsg+~6.4.18-16.6.1+dfsg+~6.4.18-26.6.1+dfsg-1	None known
`node-elliptic` Debian:13	before 6.5.7+dfsg-1	6.5.7+dfsg-1
`node-elliptic` Debian:14	before 6.5.7+dfsg-1	6.5.7+dfsg-1

Show 11 moreShow less

Affected packages
Package	Affected	Fixed
`elliptic` npm	5.2.1 up to 6.5.7	6.5.7
`elliptic` Root:npm	before 6.5.4-aikido.2	6.5.4-aikido.2
`@rootio/elliptic` Root:npm	before 6.5.4-root.io.2	6.5.4-root.io.2
`node-elliptic` Ubuntu:18.04:LTS	All versions, plus listed versions 6.4.0+dfsg-1	None known
`node-elliptic` Ubuntu:20.04:LTS	All versions, plus listed versions 6.5.1~dfsg-16.5.1~dfsg-2	None known
`node-elliptic` Ubuntu:22.04:LTS	All versions, plus listed versions 6.5.4~dfsg-1	None known
`node-elliptic` Ubuntu:24.04:LTS	All versions, plus listed versions 6.5.4~dfsg-2	None known
`node-elliptic` Ubuntu:25.10	All versions, plus listed versions 6.6.1+dfsg-1	None known
`node-elliptic` Ubuntu:26.10	All versions, plus listed versions 6.6.1+dfsg+~6.4.18-16.6.1+dfsg+~6.4.18-2	None known
`node-elliptic` Ubuntu:26.04:LTS	All versions, plus listed versions 6.6.1+dfsg-16.6.1+dfsg+~6.4.18-1	None known
`velociraptor` openSUSE:Tumbleweed From an advisory covering 27 CVEs	before 0.7.0.4.git142.862ef23-1.1	0.7.0.4.git142.862ef23-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	fevar54/CVE-2024-42461	2024-08-06

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, aliases	OSV
Nov 6, 2026	affected
Nov 4, 2026	affected, aliases, cwes, facts, references
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-42461 is a critical vulnerability (CVSS 9.1) in Elliptic Project Elliptic, published August 2, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in elliptic 6.5.7.

References

Show 32 moreShow less