TI-2026-04007 Aliases CVE-2026-4603 GHSA-464q-cqxq-xhgr

Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to…

LOW 22CWE-369Published 2026-03-23 · Updated 2026-03-23

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-369.

Summary

Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00102 0th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial jsrsasign: 11.1.1jsrsasign (npm): 11.1.1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	jsrsasign	before 11.1.1	11.1.1	Patch available	CNA
—	jsrsasign (npm)	before 11.1.1	11.1.1	Patch available	GHSA-464q-cqxq-xhgr

jsrsasign Vendor— Affected before 11.1.1 Fixed in 11.1.1 Patch available CNA
jsrsasign (npm) Vendor— Affected before 11.1.1 Fixed in 11.1.1 Patch available GHSA-464q-cqxq-xhgr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kjur:jsrsasign::::::node.js::*	before 11.1.1	Vulnerable	Kjur

cpe:2.3:a:kjur:jsrsasign:*:*:*:*:*:node.js:*:* Versions before 11.1.1 Vulnerable ·Kjur

Remediation

Fix · CNA jsrsasign Fixed in 11.1.1
Fix · GHSA-464q-cqxq-xhgr jsrsasign (npm) Fixed in 11.1.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-03-23
jsrsasign 11.1.1
6 records Highest priority Priority HIGH 3 HIGH, 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-04006 Incorrect numeric conversion in jsrsasignPriority HIGH 77
- TI-2026-04002 Infinite loop in jsrsasignPriority HIGH 77
- TI-2026-04004 Improper signature verification in jsrsasignPriority HIGH 74
Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Migration Toolkit for Virtualization	Affected	No fix yet: Fix deferred
Red Hat Quay 3	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-4603
2026-10-03 Alias added: GHSA-464q-cqxq-xhgr

References

Other 2

TI-2026-04006 Incorrect numeric conversion in jsrsasign CVSS 4.0HIGH 8.7
TI-2026-04002 Infinite loop in jsrsasign CVSS 4.0HIGH 8.7
TI-2026-04004 Improper signature verification in jsrsasign CVSS 4.0CRITICAL 9.1
TI-2026-04003 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to… CVSS 4.0CRITICAL 9.3
TI-2020-11771 An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. CVSS 3.1CRITICAL 9.8
TI-2020-11770 An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. CVSS 3.1CRITICAL 9.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences