Опубликовано: 23 мар. 2026
Источник: github
Github: Прошло ревью
CVSS4: 7.7
CVSS3: 7.5
Описание
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
Пакеты
Наименование
jsrsasign
npm
Затронутые версииВерсия исправления
< 11.1.1
11.1.1