Is CVE-2026-4600 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4600 being exploited in the wild.

How severe is CVE-2026-4600?

High severity, with a CVSS score of 7.4, published 23 March 2026.

Which products and versions are affected?

jsrsasign (npm) < 11.1.1, SEMVER:introduced=0,fixed=11.1.1.

Is there a fix for CVE-2026-4600?

Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4600 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4600?

Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4600: kjur jsrsasign signature forgery via DSA domain parameter validation

Q: Which products and versions are affected?

jsrsasign (npm) < 11.1.1, SEMVER:introduced=0,fixed=11.1.1.

Q: Is there a fix for CVE-2026-4600?

Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-4600 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-4600?

Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4600 · Severity: high · CVSS 7.4 · Published 2026-03-23

jsrsasign is a popular JavaScript library used for cryptography, including the creation and verification of digital signatures and security certificates. A flaw in how the library handles certain digital signature parameters allows an attacker to create fake signatures or certificates that appear valid. This could allow an attacker to impersonate trusted services, bypass security checks, or provide fraudulent data that the system incorrectly trusts as authentic.

Technologies: jsrsasign (npm). Vendors: npm.

Quick answers

Is CVE-2026-4600 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4600 being exploited in the wild.
How severe is CVE-2026-4600?: High severity, with a CVSS score of 7.4, published 23 March 2026.
Which products and versions are affected?: jsrsasign (npm) < 11.1.1, SEMVER:introduced=0,fixed=11.1.1.
Is there a fix for CVE-2026-4600?: Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4600 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4600?: Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsrsasign (npm): upgrade to 11.1.1 or later
```
npm install jsrsasign@11.1.1
```

Technical details

The jsrsasign library (versions prior to 11.1.1) fails to properly validate DSA domain parameters within the 'KJUR.crypto.DSA.setPublic' function and related X.509 verification flows. By supplying specifically crafted, invalid domain parameters (such as g=1, y=1, and r=1), an attacker can satisfy the cryptographic verification equation regardless of the actual message hash. This allows for universal signature forgery and the creation of fraudulent X.509 certificates that 'X509.verifySignature()' will incorrectly accept as valid. The fix, introduced in version 11.1.1, implements strict validation of domain parameters (p, q, g, and y) during the public key import process.

Affected products

kjur jsrsasign < 11.1.1

Identifiers

CVE-2026-4600
GHSA-wvqx-v3f6-w8rh

Timeline

2026-02-20: patched: Fix merged into master branch via PR #646
2026-03-23: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.