Junglewise Threat Intelligence

CVE-2026-4258: Stanford SJCL private key recovery via Invalid Curve Attack

CVE-2026-4258 · Severity: high · CVSS 7.5 · Published 2026-03-17

Vendors: npm.

Executive brief

SJCL (Stanford JavaScript Crypto Library) is a widely-used cryptographic library for JavaScript applications. The library's elliptic curve cryptography implementation fails to validate that public keys lie on the claimed elliptic curve when initialized with point objects, allowing an attacker to recover private keys through off-curve point attacks. An attacker can perform ECDH operations with crafted invalid points and extract key material from the deterministic outputs, completely compromising the confidentiality of encrypted communications.

Technical details

The vulnerability is an improper verification of cryptographic signatures (CWE-347) and invalid input validation (CWE-20) in the elliptic curve constructor sjcl.ecc.basicKey.publicKey(). The function accepts point objects directly without validation, bypassing the isValid() check that is performed when points are provided as bit arrays via the fromBits() path. Attackers can construct off-curve points (where y² ≠ x³ + 7 mod p) that lie on alternative virtual curves with small subgroup orders. When a victim performs ECDH scalar multiplication on these crafted points, the short Weierstrass addition formulas do not reference the curve parameter b and thus compute correctly on the virtual curve. The dhJavaEc() function returns the raw x-coordinate of the result without hashing, providing a direct plaintext oracle. By sending multiple off-curve points designed to have small prime factors in their group order, an attacker can recover the victim's private key modulo each small prime via Pohlig-Hellman, then reconstruct the full key using the Chinese Remainder Theorem. All versions ≤1.0.8 are affected; patches are available in version 1.0.9 and later.

Affected products

  • bitwiseshiftleft SJCL <=1.0.8

Timeline

  • 2026-02-17: disclosed
  • 2026-03-17: advisory
  • 2026-03-25: patched: Fixed in version 1.0.9

References