Is CVE-2026-4601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4601 being exploited in the wild.

How severe is CVE-2026-4601?

High severity, with a CVSS score of 8.7, published 23 March 2026.

Which products and versions are affected?

jsrsasign (npm) SEMVER:introduced=0,fixed=11.1.1.

Is there a fix for CVE-2026-4601?

Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4601 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4601?

Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4601: jsrsasign private key recovery via missing DSA check in signWithMessageHash

CVE-2026-4601 · Severity: high · CVSS 8.7 · Published 2026-03-23

jsrsasign is a popular JavaScript library used for digital signatures and encryption. A flaw in its digital signature process allows an attacker to potentially recover a server's private key if an invalid signature is generated. If a private key is stolen, an attacker could impersonate the service, decrypt sensitive data, or forge official communications.

Technologies: jsrsasign (npm). Vendors: npm.

Quick answers

Is CVE-2026-4601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4601 being exploited in the wild.
How severe is CVE-2026-4601?: High severity, with a CVSS score of 8.7, published 23 March 2026.
Which products and versions are affected?: jsrsasign (npm) SEMVER:introduced=0,fixed=11.1.1.
Is there a fix for CVE-2026-4601?: Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4601 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4601?: Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jsrsasign (npm): upgrade to 11.1.1 or later
```
npm install jsrsasign@11.1.1
```

Technical details

The vulnerability exists in the `KJUR.crypto.DSA.signWithMessageHash` function. The implementation fails to comply with FIPS 186-4 §4.6, which requires that if the DSA signature components 'r' or 's' are zero, the signer must select a new ephemeral key 'k' and retry the process. Because jsrsasign emits these invalid signatures without retrying, an attacker observing a signature where s=0 can solve for the private key 'x' using the formula x = -H(m) * r^-1 mod q. While the natural probability of this occurring is low (~1/q), the impact is a total compromise of the private key. This is addressed in version 11.1.1 by adding a retry loop.

Affected products

kjur jsrsasign < 11.1.1

Identifiers

CVE-2026-4601
GHSA-w8q8-93cx-6h7r

Timeline

2026-02-16: disclosed: Vulnerability reported by Kr0emer
2026-02-20: patched: Fix merged into master branch
2026-03-23: advisory: CVE-2026-4601 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.