NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · npm

CVE-2026-4599: jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

criticalCVSS 4.0 9.3 · 3.1 9.1GHSA-5jx8-q4cp-rhh6

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.

Published Mar 23, 2026 · Updated Jul 21, 2026

Affected packages

jsrsasign

Ecosystem
npm
Affected
>= 7.0.0, < 11.1.1
Fixed in
11.1.1
Check
npm ls jsrsasign

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology