CVE-2026-4598: Kjur Jsrsasign

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Affected products

• Kjur Jsrsasign: before 11.1.1 (fixed in 11.1.1)

Published 2026-03-23. Last modified 2026-09-10.