CVE-2024-48949

CVE-2024-48949 is a critical vulnerability affecting the Elliptic package for Node.js, specifically in versions prior to 6.5.6. The flaw, residing in the verify function of lib/elliptic/eddsa/index.js, stems from missing validation checks for signature values, leading to a CWE-347 (Improper Verification of Cryptographic Signature) weakness. This vulnerability carries a CVSS score of 9.1 (CRITICAL), indicating it is remotely exploitable with low attack complexity, and could result in high impact to confidentiality and integrity. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered community discussion and media coverage, including a detailed analysis by Trail of Bits.