# jsrsasign (npm) vulnerabilities 12 known vulnerabilities (3 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 11.1.5 (Aug 14, 2026): no advisory affects it - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 2.3M - Dependents: 517 - Releases: 156 since 0.0.1 (Oct 6, 2013) - Registry: https://www.npmjs.com/package/jsrsasign - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-4603: 0.0.1 to 11.1.0 (11.1.1 is outside it) - CVE-2026-4601: 0.0.1 to 11.1.0 (11.1.1 is outside it) - CVE-2026-4599: 7.0.0 to 11.1.0 (11.1.1 is outside it) - CVE-2026-4598: 0.0.1 to 11.1.0 (11.1.1 is outside it) - CVE-2026-4602: 0.0.1 to 11.1.0 (11.1.1 is outside it) - CVE-2026-4600: 0.0.1 to 11.1.0 (11.1.1 is outside it) - CVE-2024-21484: 0.0.1 to 10.9.0 (11.0.0 is outside it) - CVE-2022-25898: 4.8.2 to 10.5.24 (10.5.25 is outside it) - CVE-2021-30246: 0.0.1 to 10.1.13 (10.2.0 is outside it) - CVE-2020-14966: 4.8.2 to 8.0.18 (8.0.19 is outside it) - CVE-2020-14968: 4.8.2 to 8.0.16 (8.0.17 is outside it) - CVE-2020-14967: 0.0.1 to 8.0.17 (8.0.18 is outside it) ## Advisories (12) ### [CVE-2026-4603](https://cve.now/CVE-2026-4603): Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in… - Severity: Medium 5.1 - Published: Mar 23, 2026 - Affected: fixed in 11.1.1. - Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure). - The latest release, 11.1.5, is not affected. - 20% of jsrsasign downloads last week were affected versions (522.2K). ### [CVE-2026-4601](https://cve.now/CVE-2026-4601): Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash… - Severity: Critical 9.4 - Published: Mar 23, 2026 - Affected: fixed in 11.1.1. - Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure). - The latest release, 11.1.5, is not affected. - 20% of jsrsasign downloads last week were affected versions (522.2K). ### [CVE-2026-4599](https://cve.now/CVE-2026-4599): Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the… - Severity: Critical 9.3 - Published: Mar 23, 2026 - Affected: from 7.0.0, fixed in 11.1.1. - Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure). - The latest release, 11.1.5, is not affected. - 20% of jsrsasign downloads last week were affected versions (517.3K). ### [CVE-2026-4598](https://cve.now/CVE-2026-4598): Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the… - Severity: High 8.7 - Published: Mar 23, 2026 - Affected: fixed in 11.1.1. - Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure). - The latest release, 11.1.5, is not affected. - 20% of jsrsasign downloads last week were affected versions (522.2K). ### [CVE-2026-4602](https://cve.now/CVE-2026-4602): Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative… - Severity: High 8.7 - Published: Mar 23, 2026 - Affected: fixed in 11.1.1. - Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure). - The latest release, 11.1.5, is not affected. - 20% of jsrsasign downloads last week were affected versions (522.2K). ### [CVE-2026-4600](https://cve.now/CVE-2026-4600): Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA… - Severity: Critical 9.1 - Published: Mar 23, 2026 - Affected: fixed in 11.1.1. - Fixed in 11.1.1 (released Feb 20, 2026, 31 days before disclosure). - The latest release, 11.1.5, is not affected. - 20% of jsrsasign downloads last week were affected versions (522.2K). ### [CVE-2024-21484](https://cve.now/CVE-2024-21484): Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. - Severity: High 7.5 - Published: Jan 22, 2024 - Affected: fixed in 11.0.0. - Fixed in 11.0.0 (released Jan 16, 2024, 6 days before disclosure). - The latest release, 11.1.5, is not affected. - 7.9% of jsrsasign downloads last week were affected versions (208K). ### [CVE-2022-25898](https://cve.now/CVE-2022-25898): Improper Verification of Cryptographic Signature - Severity: High 7.7 - Published: Jul 1, 2022 - Affected: from 4.8.0, fixed in 10.5.25. - Fixed in 10.5.25 (released Jun 23, 2022, 8 days before disclosure). - The latest release, 11.1.5, is not affected. - 2.5% of jsrsasign downloads last week were affected versions (64.9K). ### [CVE-2021-30246](https://cve.now/CVE-2021-30246): In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. - Severity: Unrated - Published: Apr 7, 2021 - Affected: fixed in 10.2.0. - Fixed in 10.2.0 (released Apr 13, 2021, 6 days after disclosure). - The latest release, 11.1.5, is not affected. - 2.1% of jsrsasign downloads last week were affected versions (56.1K). ### [CVE-2020-14966](https://cve.now/CVE-2020-14966): An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. - Severity: Unrated - Published: Jun 22, 2020 - Affected: from 4.0.0, fixed in 8.0.19. - Fixed in 8.0.19 (released Jun 22, 2020, the day of disclosure). - The latest release, 11.1.5, is not affected. - 0.6% of jsrsasign downloads last week were affected versions (16.1K). ### [CVE-2020-14968](https://cve.now/CVE-2020-14968): An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. - Severity: Unrated - Published: Jun 22, 2020 - Affected: from 3.0.0, fixed in 8.0.17. - Fixed in 8.0.17 (released Jun 19, 2020, 3 days before disclosure). - The latest release, 11.1.5, is not affected. - 0.6% of jsrsasign downloads last week were affected versions (15.9K). ### [CVE-2020-14967](https://cve.now/CVE-2020-14967): An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. - Severity: Unrated - Published: Jun 22, 2020 - Affected: fixed in 8.0.18. - Fixed in 8.0.18 (released Jun 20, 2020, 2 days before disclosure). - The latest release, 11.1.5, is not affected. - 0.6% of jsrsasign downloads last week were affected versions (16.2K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/jsrsasign Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.