CVE-2025-14505 is a medium-severity vulnerability in the Elliptic package's ECDSA implementation, where an incorrect computation of the byte-length of the ephemeral value 'k' leads to truncation when 'k' has leading zeros. This flaw causes faulty digital signatures and breaks legitimate transactions or communications. More critically, attackers who obtain both a faulty signature and a correct signature for the same input under certain conditions may derive the secret private key, compromising cryptographic confidentiality. The vulnerability affects all Elliptic versions up to and including 6.6.1. Exploitation requires network access but no privileges or user interaction, and no known exploits are currently in the wild. European organizations relying on Elliptic for cryptographic operations, especially in financial or blockchain applications, face risks of transaction failures and potential key compromise. Mitigation involves updating to a patched Elliptic version once available, auditing signature generation for anomalies, and implementing additional cryptographic safeguards. Countries with significant blockchain, fintech, and cryptography-dependent sectors such as Germany, the UK, France, and the Netherlands are most likely to be impacted.
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
