Is jsrsasign 10.1 vulnerable?
npm · 14 releases from 10.1.0 to 10.1.13 · latest jsrsasign is 11.1.5 · checked 2 Nov 2026
Yes: 10 known advisories
Yes. jsrsasign 10.1.13, the last 10.1 release, is affected by 10 known security advisories (2 critical, 6 high, 1 medium, 1 low), including CVE-2026-4599, CVE-2021-30246, CVE-2026-4598. Upgrade to 11.1.1 or later to fix all of them.
npm install jsrsasign@11.1.1Advisories affecting jsrsasign 10.1.13
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
- Affected
- >=7.0.0 <11.1.1
- Fixed in
- 11.1.1
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations
- Affected
- <11.1.1
- Fixed in
- 11.1.1
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
- Affected
- <11.0.0
- Fixed in
- 11.0.0
JWS and JWT signature validation vulnerability with special characters
- Affected
- >=4.8.0 <10.5.25
- Fixed in
- 10.5.25
Signatures are mistakenly recognized to be valid in jsrsasign
- Affected
- <10.2.0
- Fixed in
- 10.2.0
RSA signature validation vulnerability on maleable encoded message in jsrsasign
- Affected
- <10.2.0
- Fixed in
- 10.2.0
Which of your client projects are still on jsrsasign 10.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact jsrsasign version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other jsrsasign versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.