chore(deps): update dependency jsrsasign to v11.1.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jsrsasign (source)	11.1.0 → 11.1.1

Review

• Updates have been tested and work
• If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

---

jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations

CVE-2026-4603 / GHSA-464q-cqxq-xhgr

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4603
• https://github.com/kjur/jsrsasign/pull/649
• https://github.com/kjur/jsrsasign/commit/dc41d49fac4297e7a737a3ef8ebd0aa9c49ef93f
• https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3
• https://github.com/kjur/jsrsasign
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

CVE-2026-4599 / GHSA-5jx8-q4cp-rhh6

More information

Details

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4599
• https://github.com/kjur/jsrsasign/pull/647
• https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
• https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
• https://github.com/kjur/jsrsasign
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

CVE-2026-4598 / GHSA-8g7p-jf3g-gxcp

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4598
• https://github.com/kjur/jsrsasign/pull/648
• https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323
• https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264
• https://github.com/kjur/jsrsasign
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass

CVE-2026-4602 / GHSA-8qwj-4jxw-m8jw

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4602
• https://github.com/kjur/jsrsasign/pull/650
• https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195
• https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5
• https://github.com/kjur/jsrsasign
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

CVE-2026-4601 / GHSA-w8q8-93cx-6h7r

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4601
• https://github.com/kjur/jsrsasign/pull/645
• https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb
• https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586
• https://github.com/kjur/jsrsasign
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic

CVE-2026-4600 / GHSA-wvqx-v3f6-w8rh

More information

Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4600
• https://github.com/kjur/jsrsasign/pull/646
• https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60
• https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7
• https://github.com/kjur/jsrsasign
• https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

kjur/jsrsasign (jsrsasign)

v11.1.1

Compare Source

---

Configuration

📅 Schedule: (in timezone America/Montreal)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.