GHSA-8g7p-jf3g-gxcp

Suggest an improvement
Source
https://github.com/advisories/GHSA-8g7p-jf3g-gxcp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8g7p-jf3g-gxcp/GHSA-8g7p-jf3g-gxcp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8g7p-jf3g-gxcp
Aliases
Published
2026-03-23T06:30:29Z
Modified
2026-07-21T14:00:32Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).

Database specific 
{
    "cwe_ids":  [
        "CWE-1287",
        "CWE-835"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-29T15:51:28Z",
    "nvd_published_at":  "2026-03-23T06:16:21Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / jsrsasign

Package

Name
jsrsasign
View open source insights on deps.dev
Purl
pkg:npm/jsrsasign

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.1.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8g7p-jf3g-gxcp/GHSA-8g7p-jf3g-gxcp.json"