Private Key Extraction Vulnerability in tiny-secp256k1 by BitcoinJS
CVE-2024-49364

8.1HIGH

Key Information:

Vendor

Bitcoinjs

Status
Tiny-secp256k1
Vendor
CVE Published:
1 July 2025

What is CVE-2024-49364?

A vulnerability in the tiny-secp256k1 library allows for the potential extraction of private keys when signing malicious JSON-stringifiable objects. This particularly affects environments where the NPM buffer package is utilized. A circumvention of the Buffer.isBuffer check enables k reuse across different messages, which can lead to the compromise of private keys through invalid messages. The issue has been resolved in version 1.1.7.

Affected Version(s)

tiny-secp256k1 < 1.1.7

References

https://github.com/bitcoinjs/tiny-secp256k1/security/advi...
x_refsource_CONFIRM
https://github.com/bitcoinjs/tiny-secp256k1/pull/140
x_refsource_MISC

CVSS V4

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-49364 : Private Key Extraction Vulnerability in tiny-secp256k1 by BitcoinJS