The libsodium update fixes two security issues: CVE-2025-15444, a cryptographic bypass caused by improper elliptic curve point validation, and CVE-2025-69277, which involves incorrect validation of elliptic curve points in the crypto_core_ed25519_is_valid_point function when handling custom cryptography or untrusted data. The update also introduces new functions for secure IP address encryption and anonymization, improves performance on ARM platforms, and adds mitigations against compiler-induced side channels and speculative execution attacks. The crypto_core_ed25519_is_valid_point function now properly rejects small-order points not in the main subgroup, enhancing cryptographic validation.

These vulnerabilities could allow cryptographic bypasses due to improper validation of elliptic curve points, potentially weakening the security guarantees of cryptographic operations relying on libsodium. The impact is medium severity as per the provided data. No known exploits are reported in the wild.

A security update to libsodium including these fixes is available. Users should update to the fixed version (1.0.21) or later to address these vulnerabilities. No additional mitigation steps are indicated beyond applying the update.