StackPrism

npm package

elliptic vulnerabilities by version

The latest release, 6.6.1 (Nov 13, 2024), has 1 known vulnerability. 100% of last week’s 14.5M downloads went to versions with known vulnerabilities. OSV.dev lists 9 advisories for elliptic; the newest was published on Jan 8, 2026.

npm (opens in a new tab) describes it as “EC cryptography”

Latest release
6.6.1
Nov 13, 2024, 1 known vulnerabilities
Downloads last week
14.5M
All versions, from npm
Advisories on OSV.dev
9
Newest Jan 8, 2026
Licence
MIT
OpenSSF Scorecard
1.6/10
indutny/elliptic (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
6.6.1latestNov 13, 20241 known vulnerability, worst rated low10.5M
6.5.4Feb 2, 20217 known vulnerabilities, worst rated critical2M
6.5.3Jun 18, 20208 known vulnerabilities, worst rated critical413.2K
6.5.5Mar 5, 20247 known vulnerabilities, worst rated critical290.7K
6.5.2Nov 22, 20199 known vulnerabilities, worst rated critical237.2K
6.4.0Feb 22, 20179 known vulnerabilities, worst rated critical231.4K
6.4.1Aug 9, 20189 known vulnerabilities, worst rated critical229.5K
6.5.7Aug 14, 20243 known vulnerabilities, worst rated critical150.9K

Who is still on a vulnerable elliptic

100% of last week’s 14.5M elliptic downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. elliptic doesn’t publish support dates we can check.

LineNewest releaseReleased
66.6.1Nov 13, 2024
55.2.1Oct 28, 2015
44.1.0Jul 4, 2015
33.1.0Jun 11, 2015
22.0.2Feb 7, 2015
11.0.1Jan 12, 2015

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. LowCVE-2025-14505 on OSV.dev (opens in a new tab)GHSA-848j-6mx2-7j84

    Elliptic Uses a Cryptographic Primitive with a Risky Implementation

    Affects <= 6.6.1. Published Jan 8, 2026.

  2. CriticalGHSA-vjh7-7g9h-fjfh on OSV.dev (opens in a new tab)

    Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)

    Affects < 6.6.1. Published Feb 12, 2025.

  3. LowCVE-2024-48948 on OSV.dev (opens in a new tab)GHSA-fc9h-whq2-v747

    Valid ECDSA signatures erroneously rejected in Elliptic

    Affects < 6.6.0. Published Oct 15, 2024.

  4. LowCVE-2024-48949 on OSV.dev (opens in a new tab)GHSA-434g-2637-qmqr

    Elliptic's verify function omits uniqueness validation

    Affects < 6.5.6. Published Oct 10, 2024.

  5. LowCVE-2024-42461 on OSV.dev (opens in a new tab)GHSA-49q7-c7j4-3p7m

    Elliptic allows BER-encoded signatures

    Affects >= 5.2.1, < 6.5.7. Published Aug 2, 2024.

All 9 advisories are on OSV.dev (opens in a new tab).

Which elliptic do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for elliptic, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.