jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

Description

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Recommendation

Update the jsrsasign package to the latest compatible version. Followings are version details:

• Affected version(s): < 11.1.1
• Patched version(s): 11.1.1

References

• GHSA-8g7p-jf3g-gxcp
• security.snyk.io
• access.redhat.com
• bugzilla.redhat.com
• security.access.redhat.com
• CVE-2026-4598
• CWE-1287
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Mermaid XY Charts are vulnerable to an infinite loop DoS - CVE-2026-71436
• Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS - CVE-2026-41150
• nanoid: custom generators can loop indefinitely when size is zero - CVE-2026-67213
• jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

jsrsasign