Skip to content
OpenAdvisories

Package · npm

jsrsasign

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.7
    CVE-2026-4601

    jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the li…

    jsrsasign npm
  • High 7.5
    CVE-2026-4598

    jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently …

    jsrsasign npm
  • High 7.5
    CVE-2026-4602

    jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verificati…

    jsrsasign npm
  • High 7.4
    CVE-2026-4600

    jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker…

    jsrsasign npm
  • High 7.5
    CVE-2024-21484

    Marvin Attack of RSA and RSAOAEP decryption in jsrsasign

    Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the …

    jsrsasign npm
  • High 7.7
    CVE-2022-25898

    Improper Verification of Cryptographic Signature

    The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Val…

    jsrsasign npm
  • High 7.5
    CVE-2020-14966

    ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign

    An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are…

    jsrsasign npm