CVE-2021-43571: 
JavaScript vulnerability analysis and mitigation

The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) version 1.1.2 contains a critical security vulnerability. The function fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages (NVD, CISA). The vulnerability was discovered and disclosed on November 9, 2021.

The vulnerability has been assigned CVE-2021-43571 with a CVSS score of 7.5, indicating a high severity level. The core issue lies in the signature verification implementation where the function does not validate whether the signature components are non-zero. This oversight in the cryptographic verification process creates a significant security weakness that undermines the library's core security guarantees (CISA).

The vulnerability allows malicious actors to forge signatures on arbitrary messages, effectively bypassing the cryptographic signature verification. This completely undermines the security of any application relying on this library for digital signature verification (NVD).

The vulnerability has been patched in version 1.1.3 of the ecdsa-node library. Users are strongly advised to upgrade to this version or later to address the security issue (GitHub Release).