Jsrsasign Project Jsrsasign — CVE-2026-4600 (Critical)

Date Mar 23, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Jsrsasign Project · Jsrsasign

CVE CVE-2026-4600

Critical vendor advisory CVE-2026-4600

Summary

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 7.4) in Jsrsasign Project Jsrsasign. Patch or mitigate promptly.

Operator check

Review CVE-2026-4600 in your asset inventory. Apply patches per vendor guidance and verify Jsrsasign is not exposed. CVSS score: 7.4.

Sources

NVD — CVE-2026-4600 Vendor reference Vendor reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed