Is elliptic 2.0 vulnerable?
npm · 3 releases from 2.0.0 to 2.0.2 · latest elliptic is 6.6.1 · checked 2 Nov 2026
Yes: 7 known advisories
Yes. elliptic 2.0.2, the last 2.0 release, is affected by 7 known security advisories (1 critical, 1 high, 1 medium, 4 low), including CVE-2020-13822, CVE-2020-28498, CVE-2025-14505. At least one has no fixed release yet.
Advisories affecting elliptic 2.0.2
Elliptic Uses a Cryptographic Primitive with a Risky Implementation
- Affected
- <=6.6.1
- Fixed in
- No fix released
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
- Affected
- <6.6.1
- Fixed in
- 6.6.1
Valid ECDSA signatures erroneously rejected in Elliptic
- Affected
- <6.6.0
- Fixed in
- 6.6.0
Elliptic's verify function omits uniqueness validation
- Affected
- <6.5.6
- Fixed in
- 6.5.6
Elliptic's ECDSA missing check for whether leading bit of r and s is zero
- Affected
- >=2.0.0 <6.5.7
- Fixed in
- 6.5.7
Elliptic Uses a Broken or Risky Cryptographic Algorithm
- Affected
- <6.5.4
- Fixed in
- 6.5.4
Signature Malleabillity in elliptic
- Affected
- <6.5.3
- Fixed in
- 6.5.3
Which of your client projects are still on elliptic 2.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact elliptic version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other elliptic versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.