5.9
Medium
CVE-2026-4603 Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL…
Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jsrsasign 11.1 | earliest → < 11.1.1 | 11.1.1 |
References
- security.snyk.io security.snyk.io
- gist.github.com gist.github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of jsrsasign
The 8 CVEs of jsrsasign →
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
8.7
High
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing…
9.1
Critical
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in…
7.5
High
CVE-2026-4602
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to…
7.5
High