Read the docs
TI-2026-04002 Aliases CVE-2026-4598GHSA-8g7p-jf3g-gxcp

Infinite loop in jsrsasign

Priority HIGH 77CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00556 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jsrsasign: 11.1.1jsrsasign (npm): 11.1.1Red Hat: 7 advisoriesRed Hat: 7 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—jsrsasignbefore 11.1.111.1.1Patch availableCNA
—org.webjars.npm:jsrsasignall versions—No fix listedCNA
—jsrsasign (npm)before 11.1.111.1.1Patch availableGHSA-8g7p-jf3g-gxcp
  • jsrsasign Vendor— Affected before 11.1.1 Fixed in 11.1.1 Patch available CNA
  • org.webjars.npm:jsrsasign Vendor— Affected all versions Fixed in — No fix listed CNA
  • jsrsasign (npm) Vendor— Affected before 11.1.1 Fixed in 11.1.1 Patch available GHSA-8g7p-jf3g-gxcp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kjur:jsrsasign:*:*:*:*:*:node.js:*:*before 11.1.1VulnerableKjur
  • cpe:2.3:a:kjur:jsrsasign:*:*:*:*:*:node.js:*:* Versions before 11.1.1 Vulnerable ·Kjur

Remediation

  • Fix · CNA jsrsasign Fixed in 11.1.1
  • Fix · GHSA-8g7p-jf3g-gxcp jsrsasign (npm) Fixed in 11.1.1 Advisory →

Red Hat 7 advisories

  • RHSA-2026:23361 Released 2026-06-04 · Red Hat rating Important
    Red Hat Quay 3.9.22
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:22840 Released 2026-06-03 · Red Hat rating Important
    Red Hat Quay 3.10.22
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:19410 Released 2026-05-19 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.9 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
Show 4 more Red Hat advisories
  • RHSA-2026:19409 Released 2026-05-19 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.10 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
  • RHSA-2026:19375 Released 2026-05-19 · Red Hat rating Important
    Red Hat Quay 3.16.4
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6720 Released 2026-04-06 · Red Hat rating Important
    Red Hat Quay 3.12.16
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    jsrsasign 11.1.1

    6 records Highest priority Priority HIGH 3 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-04006 Incorrect numeric conversion in jsrsasignPriority HIGH 77
    • TI-2026-04004 Improper signature verification in jsrsasignPriority HIGH 74
    • TI-2026-04003 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to…Priority MEDIUM 49
    Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Migration Toolkit for Virtualization 2.10Fixed RHSA-2026:19409
Migration Toolkit for Virtualization 2.9Fixed RHSA-2026:19410
Red Hat Quay 3.10Fixed RHSA-2026:22840
Red Hat Quay 3.12Fixed RHSA-2026:6720
Red Hat Quay 3.15Fixed RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2026:19375
Red Hat Quay 3.9Fixed RHSA-2026:23361
Not affected: 7 products
  • Migration Toolkit for Virtualization 2.10
  • Migration Toolkit for Virtualization 2.9
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4598
  2. 2026-10-03 Alias added: GHSA-8g7p-jf3g-gxcp
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-16 Fix available: Migration Toolkit for Virtualization 2.10 · Red Hat
  5. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 12

  • TI-2026-04006 Incorrect numeric conversion in jsrsasign CVSS 4.0HIGH 8.7
  • TI-2026-04004 Improper signature verification in jsrsasign CVSS 4.0CRITICAL 9.1
  • TI-2026-04003 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to… CVSS 4.0CRITICAL 9.3
  • TI-2020-11771 An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. CVSS 3.1CRITICAL 9.8
  • TI-2020-11770 An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. CVSS 3.1CRITICAL 9.8
  • TI-2022-09454 Improper verification of cryptographic signature in jsrsasign CVSS 3.1CRITICAL 9.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences