Is CVE-2026-4598 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4598 being exploited in the wild.

How severe is CVE-2026-4598?

High severity, with a CVSS score of 7.5, published 23 March 2026.

Which products and versions are affected?

jsrsasign (npm) < 11.1.1, SEMVER:introduced=0,fixed=11.1.1.

Is there a fix for CVE-2026-4598?

Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4598 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4598?

Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4598: jsrsasign infinite loop in BigInteger.modInverse

Q: Which products and versions are affected?

jsrsasign (npm) < 11.1.1, SEMVER:introduced=0,fixed=11.1.1.

Q: Is there a fix for CVE-2026-4598?

Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-4598 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-4598?

Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4598 · Severity: high · CVSS 7.5 · Published 2026-03-23

jsrsasign is a popular JavaScript library used for cryptography, including digital signatures and certificate processing. A flaw in how the library handles specific mathematical calculations allows an attacker to trigger an infinite loop, which permanently freezes the affected application. This results in a total denial of service, potentially crashing web servers or applications that rely on this library to process security tokens or encrypted data.

Technologies: jsrsasign (npm). Vendors: npm.

Quick answers

Is CVE-2026-4598 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4598 being exploited in the wild.
How severe is CVE-2026-4598?: High severity, with a CVSS score of 7.5, published 23 March 2026.
Which products and versions are affected?: jsrsasign (npm) < 11.1.1, SEMVER:introduced=0,fixed=11.1.1.
Is there a fix for CVE-2026-4598?: Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4598 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4598?: Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsrsasign (npm): upgrade to 11.1.1 or later
```
npm install jsrsasign@11.1.1
```

Technical details

A vulnerability exists in the jsrsasign library (specifically within ext/jsbn2.js) due to an infinite loop in the BigInteger.modInverse implementation. The bnModInverse function fails to properly normalize negative inputs or handle zero as an input, causing the binary-GCD loop to never reach an exit condition. A remote, unauthenticated attacker can exploit this by providing crafted inputs to functions that utilize modular inversion, leading to 100% CPU utilization and a permanent hang of the JavaScript execution thread. The issue is fixed in version 11.1.1 by adding early return checks for zero and normalizing negative inputs using the mod(m) function.

Affected products

kjur jsrsasign < 11.1.1

Identifiers

CVE-2026-4598
GHSA-8g7p-jf3g-gxcp

Timeline

2026-02-20: patched: Fix merged into master branch via PR #648
2026-03-23: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.