Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g.
Recommendation
Update the jsrsasign package to the latest compatible version. Followings are version details:
- Affected version(s): < 11.1.1
- Patched version(s): 11.1.1
References
Could your website be exposed too?
SmartScanner can check your website for jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
- jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation - CVE-2026-4599
- jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass - CVE-2026-4602
- jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.set - CVE-2026-4600
You might also like:
See something that needs correcting? Let us knowUpdated March 30, 2026