Skip to content
OpenAdvisories

Package · npm

jsrsasign

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-4599

    jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

    Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the privat…

    jsrsasign npm
  • Critical 9.1
    CVE-2021-30246

    RSA signature validation vulnerability on maleable encoded message in jsrsasign

    In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

    jsrsasign npm
  • Critical 9.8
    CVE-2020-14968

    RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign

    An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An…

    jsrsasign npm
  • Critical 9.8
    CVE-2020-14967

    RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign

    An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attac…

    jsrsasign npm