# CVE-2020-14967: jsrsasign RSA PKCS#1 decryption bypass with prepended zeros

Source: https://junglewise.ai/threats/cve-2020-14967-jsrsasign-rsa-pkcs-1-decryption-bypass-with-prepended-zeros  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-06-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-14967 · Severity: low · CVSS 3.1 · Published 2020-06-26

jsrsasign is a JavaScript library for cryptographic operations, including RSA encryption and decryption. The library fails to properly validate RSA-encrypted messages that contain prepended zeros, allowing an attacker to bypass decryption protections and potentially forge encrypted content. Applications using RSA PKCS#1 v1.5 or RSA-OAEP decryption are affected.

Technologies: [jsrsasign (npm)](https://junglewise.ai/threats/technologies/jsrsasign). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-14967 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-14967 being exploited in the wild.

**How severe is CVE-2020-14967?** Low severity, with a CVSS score of 3.1, published 26 June 2020.

**Which products and versions are affected?** jsrsasign (npm) SEMVER:introduced=0,fixed=8.0.18.

**Is there a fix for CVE-2020-14967?** Yes. jsrsasign (npm): upgrade to 8.0.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-14967 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-14967?** Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jsrsasign (npm): upgrade to 8.0.18 or later

  ```sh
  npm install jsrsasign@8.0.18
  ```


## Technical details

The vulnerability exists in jsrsasign's RSA PKCS#1 v1.5 and RSA-OAEP decryption implementations, where encrypted messages are represented as BigInteger. Crafted messages with prepended zeros can be decrypted despite not being valid according to the RSA standard. The root cause is insufficient validation of the message format before decryption. No authentication or network access is required; an attacker must provide a malicious encrypted message to the application. An attacker can forge the contents of encrypted messages. Memory corruption risk is mitigated by jsrsasign's use of the BigInteger class. The patch is available in version 8.0.18.

## Affected products

- jsrsasign jsrsasign < 8.0.18

## Identifiers

- CVE-2020-14967
- GHSA-xxxq-chmp-67g4

## Timeline

- 2020-06-22: disclosed
- 2020-06-23: advisory
- 2020-06-26: patched

## References

- [https://github.com/kjur/jsrsasign/security/advisories/GHSA-xxxq-chmp-67g4](https://github.com/kjur/jsrsasign/security/advisories/GHSA-xxxq-chmp-67g4)

## Related threats

- [jsrsasign division by zero in RSA public key parsing](https://junglewise.ai/threats/cve-2026-4603-jsrsasign-division-by-zero-in-rsa-public-key-parsing)
- [jsrsasign incorrect numeric conversion in BigInteger modPow](https://junglewise.ai/threats/cve-2026-4602-jsrsasign-incorrect-numeric-conversion-in-biginteger-modpow)
- [jsrsasign private key recovery via missing DSA check in signWithMessageHash](https://junglewise.ai/threats/cve-2026-4601-jsrsasign-private-key-recovery-via-missing-dsa-check-in)
- [kjur jsrsasign signature forgery via DSA domain parameter validation](https://junglewise.ai/threats/cve-2026-4600-kjur-jsrsasign-signature-forgery-via-dsa-domain-parameter)
- [jsrsasign private key recovery via biased DSA nonce generation](https://junglewise.ai/threats/cve-2026-4599-jsrsasign-private-key-recovery-via-biased-dsa-nonce-generation)