Vulnerability in create-ecdh Implementation of Node.js Crypto by Browserify

CVE-2026-129319

What is CVE-2026-129319?

The create-ecdh package by Browserify has a vulnerability related to improper input validation in its JavaScript implementation. In the affected versions (4.0.4 and below), the computeSecret and setPublicKey functions fail to properly validate peer public keys. This oversight allows an attacker to exploit the system by submitting public keys that do not conform to the expected elliptic curve, potentially enabling them to perform invalid-curve or small-subgroup attacks. By leveraging these weaknesses, an attacker who can send crafted public keys to a target employing a static private key can gradually recover the target's private key, using mathematical techniques such as the Chinese Remainder Theorem. This vulnerability highlights the importance of rigorous key validation in cryptographic implementations. The issue is addressed in version 4.0.5 of create-ecdh.

References