# CVE-2025-14505: Elliptic ECDSA signature generation implementation flaw

Source: https://junglewise.ai/threats/cve-2025-14505-elliptic-ecdsa-signature-generation-implementation-flaw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-14505 · Severity: low · CVSS 3.1 · Published 2026-01-08

Elliptic is a JavaScript library used for cryptographic elliptic-curve operations in web and Node.js applications. A flaw in its ECDSA signature generation can produce incorrect signatures and allow private key exposure under certain conditions, breaking legitimate transactions and potentially compromising cryptographic security.

Technologies: [elliptic (npm)](https://junglewise.ai/threats/technologies/elliptic). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-14505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14505 being exploited in the wild.

**How severe is CVE-2025-14505?** Low severity, with a CVSS score of 3.1, published 8 January 2026.

**Which products and versions are affected?** elliptic (npm) SEMVER:introduced=0,last_affected=6.6.1.

**Is there a fix for CVE-2025-14505?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-14505 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-14505?** Check whether you run elliptic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the ECDSA implementation's handling of the nonce value 'k' as specified in RFC 6979. When k has leading zeros, the byte-length is incorrectly computed, causing k to be truncated during signature generation. This produces invalid signatures that fail verification in compliant implementations. More critically, if an attacker obtains both a faulty signature from the vulnerable Elliptic version and a correct signature for identical inputs, they can derive the private key through cryptanalysis. The root cause is in the truncateToN function in ec/index.js, which incorrectly uses the integer representation's byte length rather than the message digest's actual length. All versions up to and including 6.6.1 are affected. Attack requires either chosen-message capability or prehashed inputs without proof of origin.

## Affected products

- indutny elliptic All versions up to and including 6.6.1

## Identifiers

- CVE-2025-14505
- GHSA-848j-6mx2-7j84

## Timeline

- 2024-10-13: disclosed: GitHub issue #321 filed by security researcher
- 2026-01-08: advisory: GHSA-848j-6mx2-7j84 and CVE-2025-14505 published

## References

- [https://github.com/indutny/elliptic/issues/321](https://github.com/indutny/elliptic/issues/321)

## Related threats

- [Elliptic ECDSA private key extraction via malformed input](https://junglewise.ai/threats/elliptic-ecdsa-private-key-extraction-via-malformed-input-286138fe)
- [Elliptic ECDSA signature verification bypass with leading zero bytes](https://junglewise.ai/threats/cve-2024-48948-elliptic-ecdsa-signature-verification-bypass-with-leading-zero)
- [Elliptic EdDSA signature malleability via missing validation](https://junglewise.ai/threats/cve-2024-48949-elliptic-eddsa-signature-malleability-via-missing-validation)
- [Elliptic signature malleability in EDDSA and ECDSA](https://junglewise.ai/threats/cve-2024-42459-elliptic-signature-malleability-in-eddsa-and-ecdsa)
- [Elliptic ECDSA signature malleability in DER parsing](https://junglewise.ai/threats/cve-2024-42460-elliptic-ecdsa-signature-malleability-in-der-parsing)