CVE-2024-48930: secp256k1-node Information Disclosure

CVE-2024-48930 Overview

CVE-2024-48930 affects secp256k1-node, a Node.js binding for an optimized C library for elliptic curve (EC) operations on the secp256k1 curve. The elliptic-based fallback implementation fails to validate that compressed public keys lie on the secp256k1 curve. Attackers can submit crafted public keys belonging to low-cardinality (invalid) curves and exploit Elliptic-Curve Diffie-Hellman (ECDH) operations to recover the private key. The flaw is tracked under CWE-354 (Improper Validation of Integrity Check Value).

Critical Impact
An attacker can fully reconstruct a victim's private key from as few as 11 ECDH sessions using inexpensive compute resources.

Affected Products

secp256k1-node versions prior to 3.8.1 (3.x branch)
secp256k1-node versions prior to 4.0.4 (4.x branch)
secp256k1-node versions prior to 5.0.1 (5.x branch)

Discovery Timeline

2024-10-21 - CVE-2024-48930 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-48930

Vulnerability Analysis

The secp256k1-node library exposes both a native C binding and a JavaScript fallback that uses the elliptic package. In the JavaScript fallback, loadUncompressedPublicKey correctly verifies that a given (x, y) point satisfies the secp256k1 curve equation. The companion routine loadCompressedPublicKey, however, derives y from x by computing a square root without confirming that the resulting point is actually on the curve.

This omission breaks the integrity guarantees of ECDH and related operations. publicKeyVerify() returns true for points that do not lie on secp256k1, and publicKeyTweakMul() produces predictable outputs that allow recovery of the tweak. The most severe outcome is a classic invalid-curve attack: by repeatedly performing ECDH with attacker-supplied points on weak curves of small order, an adversary collects partial residues of the private key and reconstructs it via the Chinese Remainder Theorem.

Root Cause

The loadCompressedPublicKey function computes y = sqrt(x^3 + b) mod p and immediately returns a key pair without ever verifying y^2 == x^3 + b. Because modular square root succeeds for many x values that are not on the curve, the function silently accepts invalid points. The patch adds the missing y^2 == x^3 + b check.

Attack Vector

The vulnerability is exploitable over the network and requires no authentication or user interaction. An attacker engages a victim service that performs ECDH using secp256k1-node and supplies compressed public keys belonging to small-order subgroups of invalid curves. After approximately 11 ECDH sessions, enough leakage exists to fully restore the static private key.

javascript

// Security patch in lib/elliptic.js (loadCompressedPublicKey)
let y = x.redSqr().redIMul(x).redIAdd(ecparams.b).redSqrt()
if ((first === 0x03) !== y.isOdd()) y = y.redNeg()

+  // x*x*x + b = y*y
+  const x3 = x.redSqr().redIMul(x)
+  if (!y.redSqr().redISub(x3.redIAdd(ecparams.b)).isZero()) return null
+
return ec.keyPair({ pub: { x: x, y: y } })

Source: secp256k1-node commit 8bd6446. The added check rejects any compressed point whose derived y does not satisfy the secp256k1 equation y^2 = x^3 + b.

Detection Methods for CVE-2024-48930

Indicators of Compromise

Repeated ECDH handshakes from a single peer using distinct, malformed compressed public keys
Application logs showing publicKeyVerify() returning true for points later flagged by an out-of-band curve check
Anomalous bursts of ecdh() or publicKeyTweakMul() calls from the same client over a short window

Detection Strategies

Inventory Node.js dependencies for secp256k1 package versions below 3.8.1, 4.0.4, or 5.0.1 using npm ls secp256k1 or Software Composition Analysis tooling
Instrument cryptographic call sites to log incoming compressed public keys and validate them with an independent curve-membership check
Correlate authentication logs with ECDH session counts per identity to surface clients triggering many short-lived key agreements

Monitoring Recommendations

Track package version drift in CI/CD pipelines and fail builds that pin vulnerable secp256k1-node versions
Alert on outbound or inbound TLS, Noise, or custom handshakes that fail downstream integrity checks immediately after ECDH completion
Capture and retain ECDH peer public keys for forensic review when private-key-bearing services are involved

How to Mitigate CVE-2024-48930

Immediate Actions Required

Upgrade secp256k1-node to version 5.0.1, 4.0.4, or 3.8.1 depending on the major version line in use
Rotate any long-term ECDH or signing keys that were used by vulnerable deployments handling untrusted public keys
Audit transitive dependencies, since secp256k1 is commonly pulled in by wallet, blockchain, and authentication libraries

Patch Information

The maintainers fixed the issue by adding an explicit on-curve check in loadCompressedPublicKey. See the GitHub Security Advisory GHSA-584q-6j8j-r5pm and patch commits 8bd6446, 9a15fff, and e256905.

Workarounds

Force the use of the native C binding rather than the elliptic JavaScript fallback where the runtime allows it
Wrap all calls to publicKeyVerify() and ECDH routines with an external on-curve check until the patched version can be deployed
Reject any compressed public key from untrusted peers and require uncompressed encoding, which is validated correctly in vulnerable versions

bash

# Upgrade to a fixed version of secp256k1-node
npm install secp256k1@^5.0.1
# or, for the 4.x branch
npm install secp256k1@^4.0.4
# or, for the 3.x branch
npm install secp256k1@^3.8.1

# Verify the resolved version
npm ls secp256k1