CVE-2026-4598: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4598?
CVE-2026-4598 is considered a critical vulnerability due to its potential to cause an infinite loop, leading to denial of service.
How do I fix CVE-2026-4598?
To fix CVE-2026-4598, upgrade the jsrsasign package to version 11.1.1 or higher.
What is the impact of CVE-2026-4598 on applications?
The impact of CVE-2026-4598 includes the potential for a denial of service condition, as processes can hang indefinitely.
Which versions are affected by CVE-2026-4598?
Versions of the jsrsasign package before 11.1.1 are affected by CVE-2026-4598.
Can CVE-2026-4598 be exploited remotely?
Yes, CVE-2026-4598 can be exploited remotely if an attacker sends crafted inputs that trigger the infinite loop.