Which versions of Jsrsasign are affected by CVE-2026-4603?

CVE-2026-4603 presents moderate security risk rated CVSS 5.9. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2026-4603?

Yes, a public proof-of-concept exploit is available for CVE-2026-4603. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4603?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Jsrsasign CVE-2026-4603

Q: What is the CVSS score of CVE-2026-4603?

CVE-2026-4603 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14380 LOW

Divide By Zero (CWE-369)

2026-03-23 snyk

GHSA-464q-cqxq-xhgr

Information Disclosure Jsrsasign

2.0

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

2.0 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.9 (MEDIUM) 2.0 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 23, 2026 - 16:08 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 05:45 euvd

EUVD-2026-14380

Analysis Generated

Mar 23, 2026 - 05:45 vuln.today

CVE Published

Mar 23, 2026 - 05:00 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

37 npm packages depend on jsrsasign (9 direct, 28 indirect)

Ecosystem-wide dependent count for version 11.1.1.

DescriptionCVE.org

Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.

AnalysisAI

jsrsasign versions before 11.1.1 contain a division by zero vulnerability in RSA public-key operations caused by improper parsing of JWK moduli that decode to zero. An attacker can supply a malicious JWK to force RSA verify and encryption operations to produce deterministic zero outputs while suppressing invalid key errors, leading to cryptographic bypass and information disclosure. A proof-of-concept exists and the vulnerability has moderate real-world risk due to its low attack complexity and local attack vector.

Technical ContextAI

The vulnerability exists in the jsrsasign library (CPE: cpe:2.3:a:n/a:jsrsasign), specifically in the RSA key parsing logic within ext/rsa.js (RSASetPublic and KEYUTIL functions) and the BigInteger modular exponentiation reduction logic in ext/jsbn.js (BigInteger.modPowInt). The root cause is classified as CWE-369 (Divide By Zero), where insufficient input validation allows a JWK with a modulus that parses to zero to bypass sanity checks. When RSA operations (signing verification, encryption) attempt modular arithmetic with a zero modulus, the division-by-zero condition collapses the computation to a zero result rather than raising an error, allowing an attacker to forge valid-appearing but cryptographically invalid outputs. This is a JavaScript cryptographic library used for JWT and JWK processing in web and Node.js environments.

RemediationAI

Immediately upgrade jsrsasign to version 11.1.1 or later via npm (npm install jsrsasign@^11.1.1) or equivalent package manager. Verify the patch is applied by checking the library version in node_modules or lock files (package-lock.json or yarn.lock), then rebuild and redeploy applications. As a compensating control pending patching, implement strict JWK validation at the application layer to reject any JWK with a modulus value of zero before passing to jsrsasign functions; additionally, validate RSA operation outputs to detect and reject zero results as cryptographic anomalies. Applications that accept JWK input from untrusted sources should implement additional cryptographic verification (e.g., signature re-validation with a hardware security module or alternate trusted library) until fully patched.