# CVE-2026-4601: jsrsasign private key recovery via missing DSA check in signWithMessageHash

Source: https://junglewise.ai/threats/cve-2026-4601-jsrsasign-private-key-recovery-via-missing-dsa-check-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-23. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-4601 · Severity: high · CVSS 8.7 · Published 2026-03-23

jsrsasign is a popular JavaScript library used for digital signatures and encryption. A flaw in its digital signature process allows an attacker to potentially recover a server's private key if an invalid signature is generated. If a private key is stolen, an attacker could impersonate the service, decrypt sensitive data, or forge official communications.

Technologies: [jsrsasign (npm)](https://junglewise.ai/threats/technologies/jsrsasign). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-4601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4601 being exploited in the wild.

**How severe is CVE-2026-4601?** High severity, with a CVSS score of 8.7, published 23 March 2026.

**Which products and versions are affected?** jsrsasign (npm) SEMVER:introduced=0,fixed=11.1.1.

**Is there a fix for CVE-2026-4601?** Yes. jsrsasign (npm): upgrade to 11.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4601 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4601?** Check whether you run jsrsasign (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jsrsasign (npm): upgrade to 11.1.1 or later

  ```sh
  npm install jsrsasign@11.1.1
  ```


## Technical details

The vulnerability exists in the `KJUR.crypto.DSA.signWithMessageHash` function. The implementation fails to comply with FIPS 186-4 §4.6, which requires that if the DSA signature components 'r' or 's' are zero, the signer must select a new ephemeral key 'k' and retry the process. Because jsrsasign emits these invalid signatures without retrying, an attacker observing a signature where s=0 can solve for the private key 'x' using the formula x = -H(m) * r^-1 mod q. While the natural probability of this occurring is low (~1/q), the impact is a total compromise of the private key. This is addressed in version 11.1.1 by adding a retry loop.

## Affected products

- kjur jsrsasign < 11.1.1

## Identifiers

- CVE-2026-4601
- GHSA-w8q8-93cx-6h7r

## Timeline

- 2026-02-16: disclosed: Vulnerability reported by Kr0emer
- 2026-02-20: patched: Fix merged into master branch
- 2026-03-23: advisory: CVE-2026-4601 published

## References

- [https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586](https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586)
- [https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb](https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb)
- [https://github.com/kjur/jsrsasign/pull/645](https://github.com/kjur/jsrsasign/pull/645)
- [https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941](https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941)

## Related threats

- [jsrsasign division by zero in RSA public key parsing](https://junglewise.ai/threats/cve-2026-4603-jsrsasign-division-by-zero-in-rsa-public-key-parsing)
- [jsrsasign incorrect numeric conversion in BigInteger modPow](https://junglewise.ai/threats/cve-2026-4602-jsrsasign-incorrect-numeric-conversion-in-biginteger-modpow)
- [kjur jsrsasign signature forgery via DSA domain parameter validation](https://junglewise.ai/threats/cve-2026-4600-kjur-jsrsasign-signature-forgery-via-dsa-domain-parameter)
- [jsrsasign private key recovery via biased DSA nonce generation](https://junglewise.ai/threats/cve-2026-4599-jsrsasign-private-key-recovery-via-biased-dsa-nonce-generation)
- [jsrsasign infinite loop in BigInteger.modInverse](https://junglewise.ai/threats/cve-2026-4598-jsrsasign-infinite-loop-in-biginteger-modinverse)