# CVE-2024-48949: Elliptic EdDSA signature malleability via missing validation

Source: https://junglewise.ai/threats/cve-2024-48949-elliptic-eddsa-signature-malleability-via-missing-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-48949 · Severity: low · CVSS 3.1 · Published 2024-10-10

Elliptic is a widely-used cryptography library for JavaScript (10+ million downloads weekly) that implements elliptic curve signature schemes. A flaw in its EdDSA signature verification allows attackers to forge alternative valid signatures for known message-signature pairs by omitting a required bounds check. This breaks the assumption of signature uniqueness, potentially compromising systems that rely on this property for authentication, consensus protocols, or data integrity.

Technologies: [elliptic (npm)](https://junglewise.ai/threats/technologies/elliptic). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-48949 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-48949 being exploited in the wild.

**How severe is CVE-2024-48949?** Low severity, with a CVSS score of 3.1, published 10 October 2024.

**Which products and versions are affected?** elliptic (npm) SEMVER:introduced=0,fixed=6.5.6.

**Is there a fix for CVE-2024-48949?** Yes. elliptic (npm): upgrade to 6.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-48949 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-48949?** Check whether you run elliptic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- elliptic (npm): upgrade to 6.5.6 or later

  ```sh
  npm install elliptic@6.5.6
  ```


## Technical details

The vulnerability is a missing cryptographic validation in the EdDSA verify function (lib/elliptic/eddsa/index.js). The FIPS 186-5 standard requires verifying that the signature component 's' satisfies 0 ≤ s < n (where n is the order of the base point). Elliptic omits the check `if (sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg())`, allowing malformed signatures to pass validation. An attacker with knowledge of a valid (message, signature) pair can derive alternative valid signatures sig' where s' ≡ s (mod n), exploiting signature malleability. The attack requires no authentication and is network-reachable for any system using the library. This is classified as CWE-347 (Improper Verification of Cryptographic Signature). A fix adding the required bounds check was published in version 6.5.6.

## Affected products

- Elliptic (indutny) elliptic versions < 6.5.6

## Identifiers

- CVE-2024-48949
- GHSA-434g-2637-qmqr

## Timeline

- 2024-10-10: disclosed: Vulnerability published as GHSA-434g-2637-qmqr
- 2024-07-17: patched: Fix merged in version 6.5.6
- 2025-11-18: other: Trail of Bits published detailed analysis of the vulnerability

## References

- [https://github.com/indutny/elliptic/commit/7ac5360118f74eb02da73bdf9f24fd0c72ff5281](https://github.com/indutny/elliptic/commit/7ac5360118f74eb02da73bdf9f24fd0c72ff5281)
- [https://blog.trailofbits.com/2025/11/18/we-found-cryptography-bugs-in-the-elliptic-library-using-wycheproof](https://blog.trailofbits.com/2025/11/18/we-found-cryptography-bugs-in-the-elliptic-library-using-wycheproof)
- [https://github.com/indutny/elliptic](https://github.com/indutny/elliptic)
- [https://github.com/indutny/elliptic/compare/v6.5.5...v6.5.6](https://github.com/indutny/elliptic/compare/v6.5.5...v6.5.6)
- [https://security.netapp.com/advisory/ntap-20241227-0003](https://security.netapp.com/advisory/ntap-20241227-0003)

## Related threats

- [Elliptic ECDSA signature generation implementation flaw](https://junglewise.ai/threats/cve-2025-14505-elliptic-ecdsa-signature-generation-implementation-flaw)
- [Elliptic ECDSA private key extraction via malformed input](https://junglewise.ai/threats/elliptic-ecdsa-private-key-extraction-via-malformed-input-286138fe)
- [Elliptic ECDSA signature verification bypass with leading zero bytes](https://junglewise.ai/threats/cve-2024-48948-elliptic-ecdsa-signature-verification-bypass-with-leading-zero)
- [Elliptic signature malleability in EDDSA and ECDSA](https://junglewise.ai/threats/cve-2024-42459-elliptic-signature-malleability-in-eddsa-and-ecdsa)
- [Elliptic ECDSA signature malleability in DER parsing](https://junglewise.ai/threats/cve-2024-42460-elliptic-ecdsa-signature-malleability-in-der-parsing)