CVE-2026-4603: jsrsasign Division by Zero Vulnerability Leading to Deterministic Zero Outputs
Summary
CVE-2026-4603: Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. Affects jsrsasign versions < 11.1.1. Fixed in 11.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsrsasign is a widely used JavaScript library that provides cryptographic functions, including support for JSON Web Tokens (JWT), digital signatures, and RSA key generation. It is commonly utilized in web applications for secure data transmission and authentication. However, versions prior to 11.1.1 are susceptible to a critical vulnerability that can compromise the integrity of RSA operations.
Vulnerability Detail
The vulnerability arises from a division by zero error in the RSASetPublic/KEYUTIL parsing path within ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can exploit this flaw by supplying a JSON Web Key (JWK) with a modulus that decodes to zero, causing RSA public-key operations, such as verification and encryption, to produce deterministic zero outputs. This behavior can obscure 'invalid key' errors, allowing malicious actors to bypass security checks and potentially compromise sensitive data.
How To Fix
Latest published version: 11.1.5 as of 23 Oct 2026
npm install jsrsasign@11.1.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.1.1
This is the first release that contains the fix.
npm install jsrsasign@11.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any JWKs being processed are validated to confirm that their modulus is not zero before performing RSA operations. This can be implemented with a simple check in your code, as shown below:
if (jwk.modulus !== 0) {
// Proceed with RSA operations
} else {
// Handle invalid key error
}
Conclusion
The CVE-2026-4603 vulnerability in the jsrsasign package poses a significant risk by allowing division by zero errors in RSA operations. It is crucial for developers to update to version 11.1.1 or later to mitigate this risk. Implementing validation checks can serve as a temporary workaround while updates are being applied.
See every vulnerability recorded for jsrsasign →
FAQ
The vulnerability can lead to RSA operations returning zero outputs, which can allow attackers to bypass security checks and potentially compromise sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of jsrsasign prior to 11.1.1 are vulnerable to this issue.
If immediate updates are not possible, implement validation checks to ensure that JWKs do not have a modulus of zero before processing them.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for jsrsasign.
