~ / search / GHSA-8g7p-jf3g-gxcp

GHSA-8g7p-jf3g-gxcp

jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

Source: GitHub Advisory Database (reviewed) High CVE-2026-4598

Packages

EcosystemPackageAffectedFixed in
npm jsrsasign < 11.1.1 11.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

References

External links from the advisory. They lead to third-party sites.