EUVD-2026-14377
GHSA-w8q8-93cx-6h7r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess DSA signing API
-
DeliverySubmit repeated signature requests
-
ExploitIdentify signatures with r=0 or s=0
-
ExecutionApply key recovery algorithm
-
PersistExtract private key
-
ImpactForge arbitrary signatures
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Cryptographic step completeness
|
| Exploitation Conditions | Exploitation requires the target system to use jsrsasign versions before 11.1.1 specifically for DSA signature generation (not just verification). The attacker must either observe multiple signing operations to detect naturally occurring zero-value signatures (probabilistically rare), or actively influence the signing process through repeated requests to force the vulnerable condition. Systems using only RSA or ECDSA algorithms within jsrsasign are not affected. Limiting exploitation: the high attack complexity (AC:H) reflects that attackers need cryptographic expertise to implement the key recovery algorithm, and must have network access to services performing DSA signing operations with observable outputs. Systems that use jsrsasign only for signature verification (not generation) cannot be exploited via this vector. Default installations are vulnerable only if DSA signing functionality is actively utilized in the application code. |
| Impact | Real-world risk is MODERATE despite the 8.8 CVSS score. The CVSS vector indicates network-accessible attack (AV:N) with high attack complexity (AC:H) requiring no privileges or user interaction, resulting in high confidentiality and integrity impact (VC:H/VI:H). However, SSVC framework rates exploitation as 'none' and automatable as 'no', reflecting the specialized conditions required. EPSS exploitation probability is very low (0.02%, 5th percentile), indicating minimal observed targeting. Publicly available exploit code exists (GitHub gist and PR references confirm POC), but no active exploitation confirmed by CISA KEV or vendor reports. The high attack complexity stems from needing to either observe multiple signing operations to identify vulnerable signatures or actively influence the signing process to force zero values. Risk is concentrated in scenarios where jsrsasign performs server-side DSA signing operations with attacker-controlled or observable inputs. Organizations using jsrsasign only for signature verification (not generation) face negligible risk. The availability of a working POC elevates this from theoretical to practical, but the narrow use case (DSA signing specifically, not RSA/ECC) and lack of widespread exploitation temper urgency compared to remotely exploitable RCE vulnerabilities. |
| Exploit ScenarioDerived | An attacker positions themselves to observe DSA signing operations by a vulnerable jsrsasign server, such as a JWT signing service or document authentication API. Through repeated requests or timing analysis, the attacker identifies signatures where r or s components equal zero (statistically rare but possible events). Using the publicly available POC code from the GitHub gist (https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586), the attacker algebraically solves for the private key x from these invalid signatures. With the recovered private key, the attacker can forge arbitrary signatures, impersonate legitimate users, sign malicious documents, or decrypt confidential communications protected by the compromised key. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 29, 2026
Private key recovery is possible in jsrsasign versions before 11.1.1 when attackers force invalid DSA signatures with zero r or s values during the signing process. The library fails to validate or retry these malformed signatures, allowing attackers to algebraically solve for the private key x from the emitted signature. Publicly available exploit code exists demonstrating the key recovery technique (EPSS: 0.02%, percentile 5%), though no confirmed active exploitation. Vendor-released patch: version 11.1.1.
Earlier versions of this analysis (1)
A cryptographic vulnerability in the jsrsasign JavaScript library allows attackers to recover DSA private keys through invalid signatures. Versions before 11.1.1 fail to validate and retry when DSA signature parameters r or s become zero during the signing process, enabling mathematical recovery of the private key from the malformed signature. A proof-of-concept exploit is available (https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586), and the CVSS score of 8.7 with Proof-of-concept Exploitation status indicates active research interest.
RemediationAI
Upgrade jsrsasign to version 11.1.1 or later, which implements proper validation to reject signatures with r=0 or s=0 and retry with a new nonce as confirmed in GitHub commit 0710e392ec35de697ce11e4219c988ba2b5fe0eb and pull request 645 (https://github.com/kjur/jsrsasign/pull/645). For Node.js projects, update package.json to specify jsrsasign version >=11.1.1 and run npm update or yarn upgrade. Red Hat customers should apply platform-specific patches per advisories at https://access.redhat.com/errata/RHSA-2026:6912 and related RHSA bulletins. If immediate patching is not feasible, implement compensating controls: (1) Migrate DSA signing operations to ECDSA or RSA-PSS algorithms which are not affected by this specific flaw (trade-off: requires certificate reissuance and client compatibility verification), (2) Implement application-layer signature validation that rejects signatures where r=0 or s=0 before accepting them (trade-off: adds processing overhead and may break legitimate but rare edge cases), (3) Restrict signing operations to trusted internal services only, removing network accessibility (trade-off: limits architectural flexibility for distributed systems). Note that verification-only usage of jsrsasign does not expose the private key recovery vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
jsrsasign is a pure JavaScript cryptographic library implementing RSA, ECC, and DSA signing algorithms. The vulnerability affects the KJUR.crypto.DSA.signWithMessageHash function in the DSA (Digital Signature Algorithm) implementation, classified as CWE-325 (Missing Cryptographic Step). DSA signatures consist of two components (r, s) derived from a random nonce k and the private key x. Proper DSA implementations must validate that neither r nor s equals zero, as this mathematical edge case allows trivial private key extraction. The affected library (CPE: cpe:2.3:a:n/a:jsrsasign:*:*:*:*:*:*:*:*) lacks this critical validation step, emitting invalid signatures without retrying with a new nonce. An attacker who can observe or influence the signing process can force these zero-value conditions and then algebraically derive the private key from the invalid signature parameters.
Know when Jsrsasign gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
Primary rating from Vendor (snyk).
CVSS VectorVendor: snyk
Lifecycle Timeline
4DescriptionCVE.org
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.
Blast Radius
ecosystem impact- 38 npm packages depend on jsrsasign (10 direct, 28 indirect)
Ecosystem-wide dependent count for version 11.1.1.
Executive ViewAI
jsrsasign library versions before 11.1.1 allow attackers to recover RSA/DSA private keys through forced invalid signature exploitation, directly compromising cryptographic authentication and data protection for any application using the vulnerable library. Organizations relying on jsrsasign for signing operations face loss of confidentiality and integrity guarantees across all protected communications and transactions.
Apply vendor patch. Immediate interim mitigation: disable or isolate jsrsasign-dependent signing services until patched; implement strict network segmentation to restrict signature request sources; consider temporary use of alternative cryptographic libraries if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in jsrsasign Cryptographic Implementation Flaws
View all 6An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Rated critical severity (CVSS 9.8), this vul
An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Rated critical severity (CVSS 9.8), this vul
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. Rated high severity (CVSS 7.5), this vulner
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized
Exploit-DB