CVE-2026-4601: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4601?
CVE-2026-4601 is considered a high severity vulnerability due to the potential for private key recovery.
How do I fix CVE-2026-4601?
To fix CVE-2026-4601, update the jsrsasign package to version 11.1.1 or later.
What versions are affected by CVE-2026-4601?
CVE-2026-4601 affects all versions of the jsrsasign package prior to 11.1.1.
What type of vulnerability is CVE-2026-4601?
CVE-2026-4601 is a cryptographic vulnerability related to improper handling of DSA signature generation.
Can CVE-2026-4601 lead to security breaches?
Yes, exploiting CVE-2026-4601 can lead to unauthorized access as an attacker can recover private keys.