HIGHCVSS 7.7EPSS 0.5%

CVE-2026-4602

jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass

Published: 2026-03-23
Modified: 2026-07-21
EPSS percentile: 40%
Aliases: GHSA-8qwj-4jxw-m8jw
Sources: github-advisory

Summary

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
npm	jsrsasign	—	11.1.1

Remediation: Upgrade to 11.1.1 or later.

References

https://github.com/advisories/GHSA-8qwj-4jxw-m8jw

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.