npm / @noble/curves

@noble/curves

What changed in @noble/curves 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

6 breaking8 security1 new APIs and options8 performance1 behavior and defaults7 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@noble/curves 231 changes

ECDH and ECDSA reject the identity even when the point type’s generic codec permits it.
2.4.0release notes
FROST enforces RFC 9591 point validation for BLS and BN.
2.4.0release notes
Non-canonical BLS signature encodings are now rejected.
2.3.0release notes
Recovered ECDSA signatures are now bound to their recovery id.
2.3.0release notes
ZIP215 mode is off by default, using stricter verification instead.
2.2.0release notes
Empty DST or count now throws.
2.2.0release notes

ECDSA signature and INTEGER sizes are bounded before bigint conversion, limiting disproportionate parsing and allocation work from malformed inputs.
2.4.0release notes
Round-one transcript substitution is hardened against, protecting users who do not preserve rounds as specified by FROST.
2.4.0release notes
POPRF replaces inversion with a constant-time version.
2.4.0release notes
Passed arguments are snapshotted so security-sensitive state cannot be mutated.
2.4.0release notes
Secret-scalar operations now use blinding, un-precomputed points use constant-time fixed-window multiplication, and modular arithmetic helpers are hardened to provide actual constant-time guarantees.
2.3.0release notes
FROST DKG round-2 retry handling was hardened.
2.3.0release notes
getPublicKey and sign got slower after reducing the window size and hardening constant-time execution; long-running apps can restore 2.2.0-level speed with precompute(8).
2.3.0release notes
X25519 was hardened against a remote timing attack that could reveal up to 4.036 bits of a long-term private key across many samples.
2.3.0release notes

BLS signatures are 2× faster.
2.3.0release notes
Verification of recovered signatures, pairing tower, FFT, Pippenger, and joint-MSM paths in FROST and OPRF were optimized.
2.3.0release notes
ECDSA and EdDSA verification is up to 32% faster.
2.3.0release notes
First getPublicKey or sign initialization is reduced by about 2× for ed25519, p256, p384, and p521.
2.3.0release notes
Weierstrass ECDH is up to 19% faster.
2.3.0release notes
x25519 getPublicKey is 2.7× faster.
2.3.0release notes
BLS point decoding is improved.
2.2.0release notes
Tree-shaking across modules was improved, resulting in smaller bundles.
2.2.0release notes release notes

Curves that disallow infinity cannot encode it; opted-in curves use the canonical SEC 1 0x00 encoding.
2.4.0release notes

The Edwards-to-Montgomery and Montgomery-to-Edwards conversion helpers were corrected.
2.3.0release notes
Uses the correct curve and curve parameters.
2.2.0release notes
DER parsing is improved.
2.2.0release notes
Fixes the Fp6 and Fp12 order for bls and bn.
2.2.0release notes
Random values are reduced modulo N instead of causing an error.
2.2.0release notes
Compilation issues on TypeScript v6 are fixed.
2.2.0release notes
Byte array types work across TypeScript 5.6 and TypeScript 5.9+.
2.2.0release notes