A AegiFlow
HIGHCVSS 7.7EPSS 0.6%

CVE-2026-4598

jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

Published
2026-03-23
Modified
2026-07-21
EPSS percentile
43%
Aliases
GHSA-8g7p-jf3g-gxcp
Sources
github-advisory

Summary

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Affected packages

EcosystemPackageAffected versionsFixed versions
npmjsrsasign11.1.1

Remediation: Upgrade to 11.1.1 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.