REPRO-2026-00225: Node.js WebCrypto EdDSA verification accepted small-order points, allowing signature verification bypass for Ed25519/Ed448 before the 29890721 fix.
REPRO-2026-00225 is verified against nodejs · other affected versions: All Node.js versions before the fix commit; affects all supported release lines (22.x, 24.x, 26.x) This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00225.
pruva-verify REPRO-2026-00225 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00225/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Node.js WebCrypto EdDSA (Ed25519/Ed448) verification accepts small-order/low-order points for public keys and signature R components. A crafted signature using a low-order public key or low-order R component satisfies subtle.verify() returning true even though the signature is mathematically invalid/trivial. The fix explicitly rejects small-order points in both the public key and R component during verification. This aligns WebCrypto behavior with WPT expectations across OpenSSL variants.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.