CVE-2021-30246: RSA signature validation vulnerability in jsrsasign
Summary
CVE-2021-30246: RSA signature validation vulnerability on maleable encoded message in jsrsasign. Affects jsrsasign versions < 10.2.0. Fixed in 10.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsrsasign package is an open-source library that provides various cryptographic functions, including RSA signature validation. It is commonly used in JavaScript applications for secure communication and data integrity. However, a vulnerability has been discovered in jsrsasign that allows for the acceptance of RSA signatures with improper PKCS#1.5 padding. This vulnerability can potentially lead to the acceptance of maliciously crafted signatures, compromising the security of the application.
Vulnerability Detail
The vulnerability in jsrsasign arises from the improper validation of RSA signatures. Normally, the decoded RSA signature value should have a byte length equal to the RSA key length. However, this check was not sufficient, allowing for the acceptance of signatures with malleable encoded messages. An attacker could exploit this vulnerability by crafting a message with a manipulated signature, potentially leading to unauthorized access, data tampering, or other malicious activities. It is important to note that creating a practical attack using this vulnerability is extremely difficult.
How To Fix
Latest published version: 11.1.5 as of 23 Oct 2026
npm install jsrsasign@11.1.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.2.0
This is the first release that contains the fix.
npm install jsrsasign@10.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to avoid using RSA signature validation in jsrsasign until the package has been updated to a secure version.
Conclusion
The RSA signature validation vulnerability in jsrsasign can potentially lead to the acceptance of maliciously crafted signatures, compromising the security of JavaScript applications. Users should upgrade to version 10.2.0 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsrsasign →
FAQ
jsrsasign is an open-source library that provides cryptographic functions, including RSA signature validation, for JavaScript applications.
This vulnerability allows for the acceptance of RSA signatures with improper padding, potentially leading to unauthorized access, data tampering, or other malicious activities.
To fix this vulnerability, upgrade to jsrsasign version 10.2.0 or later, which includes the necessary patches for proper RSA signature validation.
No, there is no known workaround for this vulnerability. It is recommended to avoid using RSA signature validation in jsrsasign until the package has been updated.
This vulnerability was reported and analyzed by Daniel Yahyazadeh (@yahyazadeh).
References
Related vulnerabilities
Recent vulnerabilities recorded for jsrsasign.
