Executive brief
jsrsasign is a JavaScript library used to perform RSA cryptographic operations like signature verification and encryption. A flaw allows an attacker to import a malformed RSA public key with a zero modulus, causing all subsequent RSA operations to produce incorrect (often zero) outputs. This breaks the ability to distinguish between a legitimate cryptographic failure and a deliberate key substitution attack, undermining the security of systems that rely on RSA verification or encryption.
Technical details
The vulnerability is a division-by-zero condition (CWE-369) compounded with improper input validation (CWE-20). The RSASetPublic/KEYUTIL.getKey() parsing path in ext/rsa.js validates only the string length of JWK parameters, not their numeric value, allowing a JWK with modulus n=0 to be imported. The BigInteger.modPowInt reduction logic in ext/jsbn.js then silently handles division by zero by returning 0 rather than throwing an exception, causing all RSA public-key operations to produce deterministic zero outputs. An attacker who can supply or influence the RSA public key (via JWKS endpoints, JWK headers, or compromised certificate sources) can inject a zero-modulus key without detection at import time. The observable impact varies by calling API: some RSA operations return a normal failure value (e.g., verify() === false), while others may throw later during padding/encoding, making it difficult to distinguish "invalid key" from "legitimate cryptographic failure." This particularly undermines systems where the attacker controls the public key (encryption contexts or BYOK flows). A patch is available in version 11.1.1.
Affected products
- kjur jsrsasign before 11.1.1
Timeline
- 2026-02-18: disclosed: Vulnerability details disclosed via GitHub gist
- 2026-02-20: patched: Fix merged in GitHub PR #649
- 2026-03-23: advisory: CVE-2026-4603 and GHSA-464q-cqxq-xhgr published