GitHub Advisoryadvisory · npm

GHSA-8g7p-jf3g-gxcp jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

HIGH Published 2026-03-23 Modified 2026-07-21 Official page ↗
Aliases
CVE-2026-4598
Ecosystem
npm
Packages
jsrsasign
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1287, CWE-835
Reviewed
2026-03-29

Affected packages

• npm jsrsasign: < 11.1.1 → fixed in 11.1.1

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Related

Alias · CVE (1)

  • CVE-2026-4598 Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the… vulnerability

Weakness · CWE (2)

  • CWE-1287 Improper Validation of Specified Type of Input weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References