Loading...
Skip to main content
GeekWala

CVE-2026-4601 — Vulnerability in jsrsasign — CVE Details

HIGH

jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

Published March 23, 2026Updated March 29, 2026Source: osv

Summary

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Advisory Timeline

  • First published March 23, 2026 (203 days ago).
  • Last revised March 29, 2026 — 6 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update jsrsasign to 11.1.1 or later
npm install jsrsasign@11.1.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

PackageEcosystemAffectedFixed In
jsrsasign
npm
All versions11.1.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.7 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-4601?
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.7/10).
How do I check if my project is affected by CVE-2026-4601?
CVE-2026-4601 affects jsrsasign. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-4601 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.7

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-w8q8-93cx-6h7r

Related CVEs

  • CVE-2026-4599
    CRITICAL

    jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

  • CVE-2026-107375
    HIGH

    JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

  • CVE-2026-107384
    HIGH

    MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies