GHSA-w8q8-93cx-6h7r

Suggest an improvement
Source
https://github.com/advisories/GHSA-w8q8-93cx-6h7r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-w8q8-93cx-6h7r/GHSA-w8q8-93cx-6h7r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w8q8-93cx-6h7r
Aliases
Published
2026-03-23T06:30:29Z
Modified
2026-03-29T16:11:30Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N/E:P CVSS Calculator
Summary
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
Details

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature.

Database specific 
{
    "cwe_ids":  [
        "CWE-325"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-29T15:51:59Z",
    "nvd_published_at":  "2026-03-23T06:16:21Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / jsrsasign

Package

Name
jsrsasign
View open source insights on deps.dev
Purl
pkg:npm/jsrsasign

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.1.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-w8q8-93cx-6h7r/GHSA-w8q8-93cx-6h7r.json"