Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@bsv/sdk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4npmAmendedPublished

    BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability

    CVE-2025-69287 · GHSA-vjpq-xx5g-qvmm

    Affected
    • npm @bsv/sdk < 2.0.0
    Fixed in
    2.0.0· Vendor fix available
    Issue
    BRC-104 Authentication Signature Data Preparation Vulnerability Summary A critical cryptographic vulnerability in the TypeScript SDK's BRC-104 authentication implementation caused incorrect signature data preparation, resulting in signature incompatibility between SDK implementations and potential authentication bypass scenarios. Details The vulnerability was located in the Peer.ts file of the TypeScript SDK, specifically in the processInitialRequest and processInitialResponse methods where signature data is prepared for BRC-104 mutual authentication. Vulnerable Code Locations: - ts-sdk/src/auth/Peer.ts lines 527-531 (signing) - ts-sdk/src/auth/Peer.ts lines 584-590 (verification) Root Cause: The TypeScript SDK incorrectly prepared signature data by: 1. Concatenating base64-encoded nonce strings: message.initialNonce + sessionNonce 2. Then decoding the concatenated base64 string: base64ToBytes(concatenatedString) This produced ~32-34 bytes of signature data instead of the correct 64…

    Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →