Which versions of Jsrsasign are affected by CVE-2026-4602?

The jsrsasign library vulnerability (CVE-2026-4602) enables attackers to forge or invalidate digital signatures without authentication, directly compromising the integrity of any application relying…. A patch is available.

How to fix or mitigate CVE-2026-4602?

Within 24 hours: Audit all applications and dependencies to identify jsrsasign usage across the organization and document version numbers; notify relevant development and security teams. Within 7 days: Implement compensating controls including signature validation logging, disable jsrsasign-dependent features if non-critical, and deploy WAF rules to detect exploitation attempts; prioritize migration planning to alternative cryptographic libraries. Within 30 days: Complete migration to jsrsasign version 11.1.1 or later (once released), or transition to alternative libraries with equivalent functionality; conduct penetration testing to verify signature validation integrity.

Jsrsasign CVE-2026-4602

Q: What is the CVSS score of CVE-2026-4602?

CVE-2026-4602 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14379 HIGH

Incorrect Conversion between Numeric Types (CWE-681)

2026-03-23 snyk

GHSA-8qwj-4jxw-m8jw

Information Disclosure Jsrsasign

7.7

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Jun 22, 2026 - 03:22 vuln.today

cvss_changed

CVSS changed

Jun 22, 2026 - 03:22 NVD

7.5 (HIGH) 7.7 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 23, 2026 - 05:45 euvd

EUVD-2026-14379

Analysis Generated

Mar 23, 2026 - 05:45 vuln.today

CVE Published

Mar 23, 2026 - 05:00 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

34 npm packages depend on jsrsasign (9 direct, 25 indirect)

Ecosystem-wide dependent count for version 11.1.1.

DescriptionCVE.org

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

AnalysisAI

The jsrsasign JavaScript library before version 11.1.1 contains a vulnerability that allows attackers to break signature verification by exploiting incorrect handling of negative exponents in modular exponentiation operations. This affects all versions prior to 11.1.1 of the jsrsasign package, enabling remote attackers without authentication to compromise cryptographic signature validation. A proof-of-concept exploit exists as indicated by the CVSS exploitability metric and public GitHub references demonstrating the attack technique.

Technical ContextAI

The jsrsasign library is a widely-used JavaScript implementation of JSON Web Signature, JSON Web Token, JSON Web Key and other cryptographic standards for web applications. The vulnerability (CWE-681: Incorrect Conversion between Numeric Types) resides in the ext/jsbn2.js file where the modPow function incorrectly handles negative exponents during modular exponentiation operations. When a negative exponent is passed to modPow, the function computes incorrect modular inverses, which are critical operations in RSA and other public-key cryptographic algorithms. The affected product is identified as cpe:2.3:a:n/a:jsrsasign:*:*:*:*:*:*:*:* covering all versions prior to the fix.

RemediationAI

Upgrade the jsrsasign package to version 11.1.1 or later, which contains the fix implemented in commit 5ea1c32bb2aa894b4bd29849839afe4f98728195 available at https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195. The patch was merged via pull request 650 at https://github.com/kjur/jsrsasign/pull/650. For npm-based projects, update the package.json dependency and run npm update or npm install to fetch the patched version. Until patching is complete, conduct thorough code review to identify any instances where external or untrusted input could influence the exponent parameter in modPow or related cryptographic operations, and implement input validation to reject negative exponent values. Additionally, consider implementing defense-in-depth measures such as cryptographic signature verification at multiple layers and enhanced logging of signature validation failures to detect potential exploitation attempts.