Skip to content
OpenAdvisories

Package · npm

jsrsasign

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-4603

    jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., v…

    jsrsasign npm
  • Medium —
    GHSA-h87q-g2wp-47pj

    Signatures are mistakenly recognized to be valid in jsrsasign

    In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

    jsrsasign npm
  • Medium 5.9
    GHSA-g753-jx37-7xwh

    ECDSA signature vulnerability of Minerva timing attack in jsrsasign

    ### Impact ECDSA side-channel attack named [Minerava](https://minerva.crocs.fi.muni.cz/) have been found and it was found that it affects to jsrsasign. Execution time of thousands signature generation have been observed then EC private key which is scalar val…

    jsrsasign npm