Is jsrsasign 11.1 vulnerable?
npm · 6 releases from 11.1.0 to 11.1.5 · latest jsrsasign is 11.1.5 · checked 2 Nov 2026
No known advisories in the last release
jsrsasign 11.1.5, the last 11.1 release, has no known advisories. 6 advisories affect earlier 11.1.x releases, so update to 11.1.5.
npm install jsrsasign@11.1.5Fixed within 11.1.x, affecting earlier releases
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
- Affected
- >=7.0.0 <11.1.1
- Fixed in
- 11.1.1
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations
- Affected
- <11.1.1
- Fixed in
- 11.1.1
Which of your client projects are still on jsrsasign 11.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact jsrsasign version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other jsrsasign versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.