# What changed in @noble/curves

> 31 changes in @noble/curves 2 from its official release notes, upgrade guides and advisories: 6 breaking, 8 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@noble/curves/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @noble/curves 2

### Breaking changes

- ECDH and ECDSA reject the identity even when the point type’s generic codec permits it. (2.4.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.4.0)
- FROST enforces RFC 9591 point validation for BLS and BN. (2.4.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.4.0)
- Non-canonical BLS signature encodings are now rejected. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- Recovered ECDSA signatures are now bound to their recovery id. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- ZIP215 mode is off by default, using stricter verification instead. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)
- Empty DST or count now throws. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)

### Security

- ECDSA signature and INTEGER sizes are bounded before bigint conversion, limiting disproportionate parsing and allocation work from malformed inputs. (2.4.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.4.0)
- Round-one transcript substitution is hardened against, protecting users who do not preserve rounds as specified by FROST. (2.4.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.4.0)
- POPRF replaces inversion with a constant-time version. (2.4.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.4.0)
- Passed arguments are snapshotted so security-sensitive state cannot be mutated. (2.4.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.4.0)
- Secret-scalar operations now use blinding, un-precomputed points use constant-time fixed-window multiplication, and modular arithmetic helpers are hardened to provide actual constant-time guarantees. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- FROST DKG round-2 retry handling was hardened. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- getPublicKey and sign got slower after reducing the window size and hardening constant-time execution; long-running apps can restore 2.2.0-level speed with precompute(8). (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- X25519 was hardened against a remote timing attack that could reveal up to 4.036 bits of a long-term private key across many samples. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)

### New APIs and options

- Implements FROST threshold signatures from RFC 9591. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)

### Performance

- BLS signatures are 2× faster. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- Verification of recovered signatures, pairing tower, FFT, Pippenger, and joint-MSM paths in FROST and OPRF were optimized. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- ECDSA and EdDSA verification is up to 32% faster. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- First getPublicKey or sign initialization is reduced by about 2× for ed25519, p256, p384, and p521. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- Weierstrass ECDH is up to 19% faster. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- x25519 getPublicKey is 2.7× faster. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- BLS point decoding is improved. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)
- Tree-shaking across modules was improved, resulting in smaller bundles. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0), [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)

### Behavior and default changes

- Curves that disallow infinity cannot encode it; opted-in curves use the canonical SEC 1 0x00 encoding. (2.4.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.4.0)

### Fixes and other changes

- The Edwards-to-Montgomery and Montgomery-to-Edwards conversion helpers were corrected. (2.3.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.3.0)
- Uses the correct curve and curve parameters. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)
- DER parsing is improved. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)
- Fixes the Fp6 and Fp12 order for bls and bn. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)
- Random values are reduced modulo N instead of causing an error. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)
- Compilation issues on TypeScript v6 are fixed. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)
- Byte array types work across TypeScript 5.6 and TypeScript 5.9+. (2.2.0) — [release notes](https://github.com/paulmillr/noble-curves/releases/tag/2.2.0)