Skip to main content
cve.nowby Sazabi
← npm
npmPackage

jsrsasign

12 known vulnerabilities (3 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
11.1.5 (Aug 14, 2026): no advisory affects it
Newest unaffected release
Every release is affected by at least one advisory
Advisories
12 · 3 critical, 4 high, 1 medium
Weekly downloads
2.3M
Dependents
517
Releases
156 since 0.0.1 (Oct 6, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

  • CVE-2026-4603Medium 5.1

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in…

    Affected: fixed in 11.1.1.

    Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure).

    The latest release, 11.1.5, is not affected.

    20% of jsrsasign downloads last week were affected versions (522.2K).

  • CVE-2026-4601Critical 9.4

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash…

    Affected: fixed in 11.1.1.

    Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure).

    The latest release, 11.1.5, is not affected.

    20% of jsrsasign downloads last week were affected versions (522.2K).

  • CVE-2026-4599Critical 9.3

    Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the…

    Affected: from 7.0.0, fixed in 11.1.1.

    Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure).

    The latest release, 11.1.5, is not affected.

    20% of jsrsasign downloads last week were affected versions (517.3K).

  • Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the…

    Affected: fixed in 11.1.1.

    Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure).

    The latest release, 11.1.5, is not affected.

    20% of jsrsasign downloads last week were affected versions (522.2K).

  • Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative…

    Affected: fixed in 11.1.1.

    Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure).

    The latest release, 11.1.5, is not affected.

    20% of jsrsasign downloads last week were affected versions (522.2K).

  • CVE-2026-4600Critical 9.1

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA…

    Affected: fixed in 11.1.1.

    Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure).

    The latest release, 11.1.5, is not affected.

    20% of jsrsasign downloads last week were affected versions (522.2K).

  • Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process.

    Affected: fixed in 11.0.0.

    Fixed in 11.0.0 (released Jan 16, 2024, 6 days before disclosure).

    The latest release, 11.1.5, is not affected.

    7.9% of jsrsasign downloads last week were affected versions (208K).

  • Improper Verification of Cryptographic Signature

    Affected: from 4.8.0, fixed in 10.5.25.

    Fixed in 10.5.25 (released Jun 23, 2022, 8 days before disclosure).

    The latest release, 11.1.5, is not affected.

    2.5% of jsrsasign downloads last week were affected versions (64.9K).

  • In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid.

    Affected: fixed in 10.2.0.

    Fixed in 10.2.0 (released Apr 13, 2021, 6 days after disclosure).

    The latest release, 11.1.5, is not affected.

    2.1% of jsrsasign downloads last week were affected versions (56.1K).

  • An issue was discovered in the jsrsasign package through 8.0.18 for Node.js.

    Affected: from 4.0.0, fixed in 8.0.19.

    Fixed in 8.0.19 (released Jun 22, 2020, the day of disclosure).

    The latest release, 11.1.5, is not affected.

    0.6% of jsrsasign downloads last week were affected versions (16.1K).

  • An issue was discovered in the jsrsasign package before 8.0.17 for Node.js.

    Affected: from 3.0.0, fixed in 8.0.17.

    Fixed in 8.0.17 (released Jun 19, 2020, 3 days before disclosure).

    The latest release, 11.1.5, is not affected.

    0.6% of jsrsasign downloads last week were affected versions (15.9K).

  • An issue was discovered in the jsrsasign package before 8.0.18 for Node.js.

    Affected: fixed in 8.0.18.

    Fixed in 8.0.18 (released Jun 20, 2020, 2 days before disclosure).

    The latest release, 11.1.5, is not affected.

    0.6% of jsrsasign downloads last week were affected versions (16.2K).