Threats affecting pkg:npm/create-ecdh

CVE-2026-129319 is a high-severity vulnerability in the create-ecdh library (versions before 4.0.5) used by browserify. The flaw involves improper input validation of peer public keys in the ECDH key agreement process, allowing attackers to submit crafted keys that can lead to private key recovery or predictable shared secrets. This issue affects the JavaScript implementation used on Node.js versions lacking native crypto.createECDH support. The vulnerability is fixed in version 4.0.5.