Description
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.
Recommendation
Update the jsrsasign package to the latest compatible version. Followings are version details:
- Affected version(s): >= 7.0.0, < 11.1.1
- Patched version(s): 11.1.1
References
Could your website be exposed too?
SmartScanner can check your website for jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction - CVE-2026-4601
- jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.set - CVE-2026-4600
- SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 - CVE-2026-34526
- Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
You might also like:
See something that needs correcting? Let us knowUpdated July 21, 2026