CVE-2026-4602: High severity npm/jsrsasign vulnerability
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jsrsasignto a version that resolves this vulnerability.Fixed in 11.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4602?
CVE-2026-4602 is classified as a high severity vulnerability due to its impact on signature verification.
How do I fix CVE-2026-4602?
To fix CVE-2026-4602, upgrade the jsrsasign package to version 11.1.1 or later.
Which versions of jsrsasign are affected by CVE-2026-4602?
Versions of the jsrsasign package prior to 11.1.1 are affected by CVE-2026-4602.
What kind of attacks can exploit CVE-2026-4602?
CVE-2026-4602 can be exploited by attackers to force incorrect computations of modular inverses, breaching signature verification.
Where is CVE-2026-4602 primarily located in the jsrsasign package?
CVE-2026-4602 is primarily found in ext/jsbn2.js within the jsrsasign package.