Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
Recommendation
Update the jsrsasign package to the latest compatible version. Followings are version details:
- Affected version(s): < 11.1.1
- Patched version(s): 11.1.1
References
Could your website be exposed too?
SmartScanner can check your website for jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Mermaid XY Charts are vulnerable to an infinite loop DoS - CVE-2026-71436
- Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS - CVE-2026-41150
- nanoid: custom generators can loop indefinitely when size is zero - CVE-2026-67213
- jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
You might also like:
See something that needs correcting? Let us knowUpdated July 21, 2026