Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-4599

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigInt

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
snyk

Description

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a jsrsasign

  • 7.0.0 to < 11.1.1affected

n/a org.webjars.npm:jsrsasign

  • 8.0.12 to < *affected

References