Signatures are mistakenly recognized to be valid in jsrsasign

Description

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

Recommendation

Update the jsrsasign package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.2.0
• Patched version(s): 10.2.0

References

• GHSA-h87q-g2wp-47pj
• kjur.github.io
• CWE-347
• OWASP 2021-A2

Related Issues

• Maker.js has Unsafe Property Copying in makerjs.extendObject - CVE-2026-24888
• Improper Validation of Query Parameters in Auth0 Next.js SDK - CVE-2025-67716
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• @digitalocean/do-markdownit has Type Confusion vulnerability - CVE-2025-59717

Tags:

npm

jsrsasign