Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accept out-of-range candidates and thus bias DSA nonces during signature generation.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-23 | 5 | Disclosure5 |
| 2026-03-31 | 1 | Disclosure1 |
CVE-2026-4599 Cryptographic Vulnerability in jsrsasign Leading to Private Key Recovery https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4599
Post summary
A cryptographic vulnerability (CVE-2026-4599) in jsrsasign that could allow private key recovery has been disclosed via Vulmon, with no PoC, exploit, or patch details provided.
Critical vulnerability (CVE-2026-4599) in `jsrsasign` allows DSA private key recovery. Review cryptographic practices and await patch. #jsrsasign #cryptography #infosec https://www.pulsepatch.io/posts/cve-2026-4599-jsrsasign-dsa-private-key-recovery
Post summary
A critical CVE-2026-4599 vulnerability in jsrsasign that permits DSA private key recovery has been disclosed, urging users to review cryptographic practices and await an official patch.
⚡ New CVE Alert: CVE-2026-4599 📊 Severity: 9.1 🚨 Risk Level: Critical 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4599 #CVE-2026-4599 #CVE #Critical #CyberSecurity #InfoSec https://t.co/UiIZUnSwlR
Post summary
The tweet announces a new CVE-2026-4599 with a severity score of 9.1, providing basic risk information but no deeper technical or mitigation details.
CVE-2026-4599 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and get… https://www.cve.org/CVERecord?id=CVE-2026-4599
Post summary
The statement announces CVE‑2026‑4599, noting that jsrsasign versions 7.0.0 through 11.1.1 are impacted by an incomplete comparison flaw involving the getRandomBigIntegerZeroToMax method.
[CVE-2026-4599: CRITICAL] Package jsrsasign versions 7.0.0 to 11.1.1 have a vulnerability allowing attackers to recover private keys. The issue lies in incomplete comparison during signature generation.#cve,CVE-2026-4599,#cybersecurity https://cvefind.com/CVE-2026-4599
Post summary
The post announces CVE-2026-4599, detailing how jsrsasign packages allow private key recovery via incomplete comparison, but offers no PoC, exploit code, patch, or claim of active exploitation.
🔴 CVE-2026-4599 - Critical Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinT... https://www.thehackerwire.com/vulnerability/CVE-2026-4599/ https://t.co/CBF6fP5AaW
Post summary
A new critical CVE-2026-4599 affecting jsrsasign up to version 11.1.1 has been disclosed, detailing a missing factor in integer comparison operations.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kjur | jsrsasign | - | node.js | - |