CVE-2026-4600: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1 - Configuration
Ensure DSA public parameters are validated in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js) so malicious domain parameters like g=1 and y=1 cannot make X509.verifySignature() accept forged DSA signatures/X.509 certificates.
KJUR.crypto.DSA (setPublic) / DSA-X509 verification flow in src/dsa-2.0.js DSA domain-parameter validation = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4600?
CVE-2026-4600 is considered a high-severity vulnerability due to its potential to allow attackers to forge cryptographic signatures.
How do I fix CVE-2026-4600?
To fix CVE-2026-4600, upgrade the jsrsasign package to version 11.1.1 or later.
Which versions of jsrsasign are affected by CVE-2026-4600?
Versions of jsrsasign prior to 11.1.1 are vulnerable to CVE-2026-4600.
What type of vulnerability is CVE-2026-4600?
CVE-2026-4600 is an Improper Verification of Cryptographic Signature vulnerability.
What impact can CVE-2026-4600 have on applications?
CVE-2026-4600 can lead to the ability for attackers to forge DSA signatures or X.509 certificates, potentially compromising application security.