CVE-2021-30246: Kjur Jsrsasign

Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days.

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

Affected products

• Kjur Jsrsasign: up to and including 10.1.13

Published 2021-04-07. Last modified 2026-06-22.