CVE-2026-4599: jsrsasign Incomplete Comparison Allows DSA Private Vulnerability

CRITICAL
Advisory Identifier: GHSA-5jx8-q4cp-rhh6
Share
CVSS 9.1
CWE-1023 CWE-338
Published
Advisory Summary

CVE-2026-4599 is a CRITICAL (CVSS 9.1) incomplete comparison allows dsa private vulnerability (CWE-1023: Incomplete Comparison with Missing Factors) affecting jsrsasign libraries in the npm ecosystem. The issue involves incomplete comparison allows dsa private key recovery via biased nonce generation. Remediation is available by upgrading affected packages to version 11.1.1.

CVE-2026-4599 at a Glance

CVE Identifier CVE-2026-4599
GHSA Identifier GHSA-5jx8-q4cp-rhh6
Severity CRITICAL
CVSS v3.1 Base Score 9.1
CWE Classification CWE-1023: Incomplete Comparison with Missing Factors
Affected Product jsrsasign
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 9.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-4599

To remediate this vulnerability, upgrade all affected jsrsasign dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

jsrsasign fixed: 11.1.1 
npm install jsrsasign@11.1.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls jsrsasign

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-4599, inspect your project dependencies using npm:

npm ls jsrsasign

Analyze the terminal output to locate any version of jsrsasign in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 11.1.1), your application is affected.

Note: The npm ls jsrsasign command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1023: Incomplete Comparison with Missing Factors, where the product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors. In jsrsasign, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.

CVE-2026-4599 Affected jsrsasign Versions

1 component(s)
Fixed Versions:
11.1.1
Product / Package Ecosystem Affected Versions Fixed Version
jsrsasign
npm/jsrsasign
npm
≥ 7.0.0
< 11.1.1
11.1.1

References

NVD — CVE-2026-4599 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4599
jsrsasign Source Repository REPOSITORY
https://github.com/kjur/jsrsasign/pull/647
Security Fix Commit FIX COMMIT
https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1
jsrsasign Security Information SECURITY
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939
jsrsasign Security Information SECURITY
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812264
jsrsasign Security Information SECURITY
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4599.json
jsrsasign Source Repository REPOSITORY
https://github.com/kjur/jsrsasign
jsrsasign Source Repository REPOSITORY
https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20
bugzilla.redhat.com/show_bug.cgi WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2450207
jsrsasign Security Information SECURITY
https://access.redhat.com/security/cve/CVE-2026-4599
access.redhat.com/errata/rhsa-2026:69... WEB
https://access.redhat.com/errata/RHSA-2026:6926
access.redhat.com/errata/rhsa-2026:69... WEB
https://access.redhat.com/errata/RHSA-2026:6912
access.redhat.com/errata/rhsa-2026:67... WEB
https://access.redhat.com/errata/RHSA-2026:6720
access.redhat.com/errata/rhsa-2026:65... WEB
https://access.redhat.com/errata/RHSA-2026:6568
access.redhat.com/errata/rhsa-2026:19... WEB
https://access.redhat.com/errata/RHSA-2026:19410
access.redhat.com/errata/rhsa-2026:19... WEB
https://access.redhat.com/errata/RHSA-2026:19409
access.redhat.com/errata/rhsa-2026:19... WEB
https://access.redhat.com/errata/RHSA-2026:19375

Frequently Asked Questions

What is CVE-2026-4599?
CVE-2026-4599 is a security vulnerability in jsrsasign involving Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation under CWE-1023: Incomplete Comparison with Missing Factors.
Which jsrsasign versions are affected?
Affected versions include releases prior to 11.1.1 across affected packages: jsrsasign.
What version fixes CVE-2026-4599?
Upgrading to 11.1.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is jsrsasign affected?
Yes, jsrsasign is affected in releases prior to 11.1.1. Upgrade your dependency to 11.1.1 or later.
What is the CVSS score of CVE-2026-4599?
CVE-2026-4599 has a CVSS v3.1 base score of 9.1 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
What CWE is associated with CVE-2026-4599?
CVE-2026-4599 is classified under CWE-1023: Incomplete Comparison with Missing Factors (The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.).
How can I check npm dependencies for CVE-2026-4599?
Run the dependency tree command: 'npm ls jsrsasign'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5jx8-q4cp-rhh6",
  "modified" : "2026-07-21T13:42:18Z",
  "published" : "2026-03-23T06:30:29Z",
  "aliases" : [ "CVE-2026-4599" ],
  "summary" : "jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation",
  "details" : "Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "jsrsasign"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "11.1.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-4599"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kjur/jsrsasign/pull/647"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1"
  }, {
    "type" : "WEB",
    "url" : "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
  }, {
    "type" : "WEB",
    "url" : "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812264"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4599.json"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/kjur/jsrsasign"
  }, {
    "type" : "WEB",
    "url" : "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2450207"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-4599"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:6926"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:6912"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:6720"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:6568"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:19410"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:19409"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:19375"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1023", "CWE-338" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-30T19:29:39Z",
    "nvd_published_at" : "2026-03-23T06:16:21Z"
  }
}