CVE-2026-4599: jsrsasign private key recovery via biased DSA nonce generation

CVE-2026-4599 · Severity: critical · CVSS 9.1 · Published 2026-03-23

jsrsasign is a JavaScript cryptography library used to create digital signatures and validate cryptographic keys. A flaw in its random number generation for DSA signatures allows attackers to recover private keys by exploiting biased nonce generation. An attacker with the ability to collect signed messages could extract the secret key used for signing, compromising the confidentiality and integrity of any system relying on this library for cryptographic operations.

Technologies: jsrsasign (npm). Vendors: npm.

Quick answers

Is CVE-2026-4599 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4599 being exploited in the wild.
How severe is CVE-2026-4599?
Critical severity, with a CVSS score of 9.1, published 23 March 2026.
Which products and versions are affected?
jsrsasign (npm) >= 7.0.0, < 11.1.1, SEMVER:introduced=7.0.0,fixed=11.1.1.
Is there a fix for CVE-2026-4599?
Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4599 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-4599?
Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jsrsasign (npm): upgrade to 11.1.1 or later
    npm install jsrsasign@11.1.1

Technical details

The vulnerability exists in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js due to incomplete compareTo checks that fail to properly validate the range of generated random values. This results in accepting out-of-range candidates during DSA nonce generation, biasing the nonces toward specific values. An attacker who can observe multiple DSA signatures produced by a vulnerable version can exploit this bias to recover the private key through lattice-based cryptanalysis or related techniques. The vulnerability affects jsrsasign versions 7.0.0 through 11.1.0 and requires no network interaction or authentication; exploitation requires only the ability to obtain signed data. A patch is available in version 11.1.1 and later.

Affected products

  • kjur jsrsasign 7.0.0 to 11.1.0

Identifiers

  • CVE-2026-4599
  • GHSA-5jx8-q4cp-rhh6

Timeline

  • 2026-02-17: disclosed
  • 2026-03-23: advisory
  • 2026-02-20: patched: Fix merged in PR #647

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.