~ / search / GHSA-464q-cqxq-xhgr

GHSA-464q-cqxq-xhgr

jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations

Source: GitHub Advisory Database (reviewed) Low CVE-2026-4603

Packages

EcosystemPackageAffectedFixed in
npm jsrsasign < 11.1.1 11.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.

References

External links from the advisory. They lead to third-party sites.