EUVD-2026-14373
GHSA-5jx8-q4cp-rhh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft multiple signing requests
-
ExploitExploit biased DSA nonces from incomplete comparison
-
ImpactRecover private key via lattice attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Exploitation Conditions | Remote unauthenticated attacker can exploit jsrsasign versions 7.0.0 through 11.1.0 when the library generates DSA signatures. Attacker intercepts multiple signatures from the vulnerable application, exploits biased nonce generation via incorrect compareTo checks in getRandomBigIntegerZeroToMax/getRandomBigIntegerMinToMax functions, and recovers the private key. No victim interaction required. |
| Impact | This represents a critical real-world risk with a CVSS score of 9.1 indicating network-based exploitation with low complexity and no privileges required. The attack vector is network-accessible (AV:N), requires low complexity (AC:L), and provides both confidentiality and integrity impact (C:H/I:H). The availability of a public proof-of-concept on GitHub (Kr0emer's Gist) significantly lowers the barrier to exploitation, as attackers can readily implement the private key recovery attack. While no EPSS or KEV data is provided, the combination of public POC availability, remotely exploitable conditions, and the fundamental nature of the cryptographic flaw make this a genuine high-priority issue rather than theoretical risk. Any application using affected jsrsasign versions for DSA signing operations is actively vulnerable to key compromise, which could enable signature forgery and authentication bypass. The patch is available via GitHub pull request 647, making this immediately actionable. |
| Exploit ScenarioDerived | An attacker monitors signatures generated by a web application using vulnerable jsrsasign for authentication tokens or document signing. By collecting multiple DSA signatures from the same private key, the attacker applies lattice-based cryptanalysis techniques (as demonstrated in the public POC at https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20) to exploit the nonce bias and mathematically recover the private signing key. With the recovered key, the attacker can forge arbitrary signatures, impersonate users, sign malicious code updates, or decrypt sensitive communications, all without requiring any authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
The jsrsasign JavaScript cryptographic library contains a critical vulnerability in its random number generation functions that allows attackers to recover private DSA keys through nonce bias exploitation. Versions 7.0.0 through 11.1.0 are affected. A proof-of-concept is publicly available (referenced in GitHub Gist), demonstrating the attack feasibility, and the vulnerability requires no authentication or user interaction for remote exploitation.
RemediationAI
Immediately upgrade jsrsasign to version 11.1.1 or later, which addresses the flawed random number generation logic through the fix implemented in GitHub pull request 647 (https://github.com/kjur/jsrsasign/pull/647) and committed as ee4b013478366cb16cea9a4bdfb218b6077f83b1 (https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1). Review the Snyk advisory at https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939 for additional guidance. Organizations unable to immediately upgrade should rotate all DSA keys that were generated or used with affected versions, as previously generated signatures may have already leaked information about the private key. Consider migrating from DSA to more modern signature algorithms like ECDSA or EdDSA where feasible, as DSA is increasingly deprecated in favor of more robust alternatives.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
jsrsasign is a widely-used pure JavaScript implementation of cryptographic operations including RSA, DSA, ECC, and X.509 certificates, commonly deployed in Node.js applications and browser-based cryptography. The vulnerability stems from CWE-1023 (Incomplete Comparison with Missing Factors) in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions within src/crypto-1.1.js. These functions incorrectly validate randomly generated numbers through flawed compareTo checks, allowing out-of-range values to be accepted as valid candidates. When used for DSA signature generation, this flaw creates a measurable bias in the nonce values, which can be exploited through mathematical analysis of multiple signatures to extract the private signing key, fundamentally breaking the security guarantees of DSA.
Know when Jsrsasign gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (snyk).
CVSS VectorVendor: snyk
Lifecycle Timeline
3DescriptionCVE.org
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.
Executive ViewAI
A critical vulnerability in the jsrsasign cryptographic library (CVE-2026-4599, CVSS 9.1) enables attackers to extract private DSA keys remotely without authentication. Any application or service using affected versions 7.0.0-11.1.0 faces immediate risk of cryptographic compromise, potentially exposing encrypted communications, digital signatures, and authenticated sessions.
No patch currently available. Interim mitigations: (1) Disable jsrsasign DSA operations if functionality permits; (2) Restrict network access to affected applications via WAF/network segmentation to trusted IPs only; (3) Monitor for suspicious cryptographic operations and key derivation patterns; (4) Implement certificate pinning to reduce reliance on DSA signatures; (5) Migrate to alternative cryptographic libraries that do not use jsrsasign; (6) Increase logging and alerting on authentication/signature failures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in jsrsasign Cryptographic Implementation Flaws
View all 6An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Rated critical severity (CVSS 9.8), this vul
An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Rated critical severity (CVSS 9.8), this vul
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. Rated high severity (CVSS 7.5), this vulner
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized
Exploit-DB