https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-4603.htmlhttps://patchthecve.com/cve/CVE-2026-4603.htmlMon, 22 Jun 2026 03:18:31 +0000MEDIUM 5.9: Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to detehttps://patchthecve.com/cve/CVE-2026-4602.htmlhttps://patchthecve.com/cve/CVE-2026-4602.htmlThu, 10 Sep 2026 13:20:22 +0000HIGH 7.5: Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative expohttps://patchthecve.com/cve/CVE-2026-4601.htmlhttps://patchthecve.com/cve/CVE-2026-4601.htmlThu, 10 Sep 2026 13:20:22 +0000HIGH 8.7: Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without https://patchthecve.com/cve/CVE-2026-4600.htmlhttps://patchthecve.com/cve/CVE-2026-4600.htmlThu, 10 Sep 2026 13:20:22 +0000HIGH 7.4: Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certifhttps://patchthecve.com/cve/CVE-2026-4599.htmlhttps://patchthecve.com/cve/CVE-2026-4599.htmlThu, 10 Sep 2026 13:20:21 +0000CRITICAL 9.1: Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect comparehttps://patchthecve.com/cve/CVE-2026-4598.htmlhttps://patchthecve.com/cve/CVE-2026-4598.htmlThu, 10 Sep 2026 13:20:20 +0000HIGH 7.5: Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., m