~ / search / GHSA-8qwj-4jxw-m8jw

GHSA-8qwj-4jxw-m8jw

jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass

Source: GitHub Advisory Database (reviewed) High CVE-2026-4602

Packages

EcosystemPackageAffectedFixed in
npm jsrsasign < 11.1.1 11.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

References

External links from the advisory. They lead to third-party sites.