CVE-2026-4258: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4258 is an Invalid Curve Attack vulnerability in the Stanford JavaScript Crypto Library (sjcl) caused by missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). All versions of the npm package sjcl up to and including 1.0.8 are affected. The vulnerability was disclosed on February 17, 2026, by researcher Kr0emer, and published to NVD on March 17, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (Snyk Advisory, GitHub Gist).

The root cause (CWE-347: Improper Verification of Cryptographic Signature; CWE-325: Missing Cryptographic Step) lies in the publicKey constructor in core/ecc.js. When a sjcl.ecc.point object is passed directly, the constructor stores it without calling isValid(), whereas the bitArray code path correctly calls curve.fromBits() which enforces curve membership. Downstream ECDH functions dh() and dhJavaEc() then perform scalar multiplication on the unvalidated point: dhJavaEc() returns the raw x-coordinate of the result with no hashing, creating a direct scalar multiplication oracle. An attacker exploits this via a classic Invalid Curve Attack (Biehl, Meyer, Müller — Crypto 2000): crafted off-curve points are placed on virtual curves with small-order subgroups, enabling Pohlig-Hellman decomposition and CRT reconstruction of the victim's full private key in approximately 44 ECDH oracle queries against secp256k1 (GitHub Gist, Snyk Advisory).

Successful exploitation allows an unauthenticated network attacker to fully recover a victim's ECDH private key, completely compromising the confidentiality of any communications or data protected by that key exchange. There is no integrity or availability impact, but the confidentiality impact is rated High. Applications relying on sjcl for ECDH key exchange — including encrypted messaging, key wrapping, or session establishment — are at risk of having all past and future encrypted communications decrypted if the private key is recovered (Snyk Advisory, GitHub Gist).

A JavaScript proof-of-concept demonstrating off-curve point acceptance is publicly available on Snyk's vulnerability database, and a detailed attack analysis gist (including a full private key recovery PoC on small parameters) was published by the discoverer Kr0emer (Snyk Advisory, GitHub Gist). No in-the-wild exploitation has been confirmed as of the time of reporting. The EPSS score is approximately 0.021% (8th percentile), indicating low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The CVSS v4.0 exploit maturity is rated Proof of Concept.

1. Reconnaissance: Identify applications using the sjcl npm package for ECDH key exchange (e.g., via package.json inspection, npm audit, or Shodan/Censys for exposed APIs).
2. Construct off-curve points: Offline, generate points P' = (x, y) where y² ≠ x³ + b (mod p) for the target curve (e.g., secp256k1/k256). These points lie on virtual curves y² = x³ + b' with group orders containing small prime factors.
3. Identify small-order subgroups: For each virtual curve, find a point of small prime order q (e.g., primes ≤ 193 for secp256k1). This step is performed entirely offline (~3,800 trial curves needed).
4. Send crafted public keys: Pass each off-curve point as a sjcl.ecc.point object (not a bitArray) to the victim's ECDH endpoint. The missing isValid() check allows the point to be accepted: new sjcl.ecc.elGamal.publicKey(curve, offCurvePoint).
5. Observe ECDH output: Collect the dhJavaEc() response, which returns the raw x-coordinate of d × P' — a direct scalar multiplication oracle requiring no decryption feedback.
6. Apply Pohlig-Hellman: For each query, brute-force d mod q offline (trivial for q ≤ 193).
7. Reconstruct private key via CRT: After ~44 queries covering distinct small primes whose product exceeds the curve order, apply the Chinese Remainder Theorem to recover the full 256-bit private key d (GitHub Gist, Snyk Advisory).

• Network: Repeated ECDH key exchange requests from a single source IP with varying public key values; public keys that fail standard curve membership checks if validated externally.
• Application Logs: Unusual volume of ECDH operations or key exchange requests in a short time window (~44+ requests per attack session); requests where the public key parameter is supplied as a raw point object rather than a serialized bitArray.
• Behavioral: Unexpected or anomalous patterns in ECDH session establishment, particularly if the same endpoint receives many distinct ephemeral public keys from the same client without completing a full protocol handshake.

Upgrade the sjcl npm package to version 1.0.9 or higher, which adds an isValid() check after storing the point in the publicKey constructor, rejecting off-curve inputs regardless of input type (GitHub Commit, Snyk Advisory). Note that the sjcl library is officially deprecated; migrating to a modern, actively maintained cryptographic library is strongly recommended for new and existing projects. As a temporary workaround if upgrading is not immediately possible, ensure that all ECDH public keys are passed as bitArrays (serialized) rather than point objects, as the bitArray code path correctly calls fromBits() → isValid().

The vulnerability was reported by researcher Kr0emer and relayed to the maintainer via the Snyk security team; the upstream README credits both parties in the patch commit (GitHub Commit). The sjcl maintainer acknowledged the issue and released version 1.0.9 as a fix, noting in the README that this is the only serious vulnerability fix made to the otherwise deprecated library. Coverage appeared on security aggregators including Snyk, ENISA EUVD, and several threat intelligence feeds shortly after disclosure.