Description
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.
Recommendation
Update the jsrsasign package to the latest compatible version. Followings are version details:
- Affected version(s): < 11.1.1
- Patched version(s): 11.1.1
References
Could your website be exposed too?
SmartScanner can check your website for jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation - CVE-2026-4599
- jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.set - CVE-2026-4600
- tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364
- secp256k1-node allows private key extraction over ECDH - CVE-2024-48930
You might also like:
See something that needs correcting? Let us knowUpdated March 29, 2026