CVE-2026-87736: Medium severity npm/mirage-crypto-ec vulnerability

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates network reachability, low attack complexity, and low privileges required. No user interaction is required.

Q: What is the likely impact if exploitation succeeds?

The reported impact is limited to availability: an out-of-bounds read involving compressed EC public keys may cause a denial-of-service condition. The provided CVSS vector reports no confidentiality or integrity impact.

Q: Which versions should be remediated?

The issue affects mirage-crypto-ec versions before 2.3.0. Upgrade to version 2.3.0 or later.

Published Sep 9, 2026

Updated

An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.

Affected Software

1 affected component

npm/mirage-crypto-ec<2.3.0

Event History

Sep 9, 2026

CVE Published

via MITRE·04:19 AM

Data Sourced

via MITRE·04:19 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates network reachability, low attack complexity, and low privileges required. No user interaction is required.

What is the likely impact if exploitation succeeds?

The reported impact is limited to availability: an out-of-bounds read involving compressed EC public keys may cause a denial-of-service condition. The provided CVSS vector reports no confidentiality or integrity impact.

Which versions should be remediated?

The issue affects mirage-crypto-ec versions before 2.3.0. Upgrade to version 2.3.0 or later.