Is CVE-2025-14505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-14505 being exploited in the wild.

How severe is CVE-2025-14505?

Low severity, with a CVSS score of 3.1, published 8 January 2026.

Which products and versions are affected?

elliptic (npm) SEMVER:introduced=0,last_affected=6.6.1.

Is there a fix for CVE-2025-14505?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-14505 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-14505?

Check whether you run elliptic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14505: Elliptic ECDSA signature generation implementation flaw

CVE-2025-14505 · Severity: low · CVSS 3.1 · Published 2026-01-08

Elliptic is a JavaScript library used for cryptographic elliptic-curve operations in web and Node.js applications. A flaw in its ECDSA signature generation can produce incorrect signatures and allow private key exposure under certain conditions, breaking legitimate transactions and potentially compromising cryptographic security.

Technologies: elliptic (npm). Vendors: npm.

Quick answers

Is CVE-2025-14505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-14505 being exploited in the wild.
How severe is CVE-2025-14505?: Low severity, with a CVSS score of 3.1, published 8 January 2026.
Which products and versions are affected?: elliptic (npm) SEMVER:introduced=0,last_affected=6.6.1.
Is there a fix for CVE-2025-14505?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-14505 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-14505?: Check whether you run elliptic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the ECDSA implementation's handling of the nonce value 'k' as specified in RFC 6979. When k has leading zeros, the byte-length is incorrectly computed, causing k to be truncated during signature generation. This produces invalid signatures that fail verification in compliant implementations. More critically, if an attacker obtains both a faulty signature from the vulnerable Elliptic version and a correct signature for identical inputs, they can derive the private key through cryptanalysis. The root cause is in the truncateToN function in ec/index.js, which incorrectly uses the integer representation's byte length rather than the message digest's actual length. All versions up to and including 6.6.1 are affected. Attack requires either chosen-message capability or prehashed inputs without proof of origin.

Affected products

indutny elliptic All versions up to and including 6.6.1

Identifiers

CVE-2025-14505
GHSA-848j-6mx2-7j84

Timeline

2024-10-13: disclosed: GitHub issue #321 filed by security researcher
2026-01-08: advisory: GHSA-848j-6mx2-7j84 and CVE-2025-14505 published

References

https://github.com/indutny/elliptic/issues/321

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.