Is jsrsasign 5.1 vulnerable?
npm · 1 release from 5.1.0 to 5.1.0 · latest jsrsasign is 11.1.5 · checked 2 Nov 2026
Yes: 13 known advisories
Yes. jsrsasign 5.1.0, the last 5.1 release, is affected by 13 known security advisories (3 critical, 7 high, 2 medium, 1 low), including CVE-2021-30246, CVE-2020-14967, CVE-2020-14968. Upgrade to 11.1.1 or later to fix all of them.
npm install jsrsasign@11.1.1Advisories affecting jsrsasign 5.1.0
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic
- Affected
- <11.1.1
- Fixed in
- 11.1.1
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations
- Affected
- <11.1.1
- Fixed in
- 11.1.1
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
- Affected
- <11.0.0
- Fixed in
- 11.0.0
JWS and JWT signature validation vulnerability with special characters
- Affected
- >=4.8.0 <10.5.25
- Fixed in
- 10.5.25
Signatures are mistakenly recognized to be valid in jsrsasign
- Affected
- <10.2.0
- Fixed in
- 10.2.0
RSA signature validation vulnerability on maleable encoded message in jsrsasign
- Affected
- <10.2.0
- Fixed in
- 10.2.0
ECDSA signature vulnerability of Minerva timing attack in jsrsasign
- Affected
- >=4.0.0 <8.0.13
- Fixed in
- 8.0.13
ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign
- Affected
- >=4.0.0 <8.0.19
- Fixed in
- 8.0.19
RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign
- Affected
- <8.0.18
- Fixed in
- 8.0.18
RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign
- Affected
- >=3.0.0 <8.0.17
- Fixed in
- 8.0.17
Which of your client projects are still on jsrsasign 5.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact jsrsasign version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other jsrsasign versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.