CVE-2026-4599: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4599 is a DSA nonce bias vulnerability in the jsrsasign JavaScript cryptographic library, classified as Incomplete Comparison with Missing Factors (CWE-1023). It affects all versions from 7.0.0 up to (but not including) 11.1.1, specifically the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js. The flaw was disclosed by researcher Kr0emer on February 17, 2026, with the fix merged on February 20, 2026, and the CVE published on March 23, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (Snyk Advisory, Red Hat Bugzilla).

The root cause is an incorrect sentinel-value comparison in the rejection-sampling loop within crypto-1.1.js. The jsbn library's BigInteger.compareTo() method returns any signed integer (not just -1, 0, or 1), but the vulnerable code checks biMax.compareTo(biRand) != -1 to determine if a random candidate is within range. When biRand > biMax, compareTo() may return a negative value other than -1 (e.g., -2, -3), causing the condition to incorrectly accept out-of-range values and breaking the rejection-sampling invariant (CWE-1023, CWE-338). A secondary issue exists in getRandomBigIntegerMinToMax, where the guard flagCompare == 1 fails silently when compareTo returns any positive integer greater than 1. This biased nonce generation exclusively affects the DSA signing path (dsa-2.0.js signWithMessageHash); ECDSA signing uses an independent RNG helper and is not affected (GitHub Gist, GitHub PR #647).

An unauthenticated remote attacker who can collect a sufficient number of DSA signatures from an application using a vulnerable jsrsasign version can exploit the biased nonce distribution to recover the DSA private key via lattice-based or Hidden Number Problem (HNP) attacks. Private key compromise enables full signature forgery, credential theft, and impersonation of the affected service or user. A ~6% nonce overflow rate was empirically observed in testing, confirming the bias is real and non-negligible; availability is not impacted, but confidentiality and integrity are both rated High (GitHub Gist, Snyk Advisory).

No confirmed weaponized exploit or in-the-wild exploitation has been reported as of the time of publication. A technical analysis document with a functional proof-of-concept collection script (demonstrating out-of-range nonce acceptance and statistical bias measurement) was published by the discoverer Kr0emer on GitHub Gist, but it does not constitute a ready-to-use private key recovery tool (GitHub Gist). The EPSS score is approximately 0.03% (19th percentile), indicating low near-term exploitation probability. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Snyk Advisory).

1. Identify target: Locate applications that use jsrsasign versions >=7.0.0 and <11.1.1 for DSA signing operations (e.g., JWT libraries, code-signing tools, authentication systems using DSA keys).
2. Collect DSA signatures: Interact with the target application to trigger DSA signature generation, collecting a large number of (message, signature) pairs — the PoC script suggests ~5,000 signatures as a starting point.
3. Instrument or observe nonce bias: Using the published PoC script (poc_collect_jsrsasign_dataset.js), collect signatures and record the raw nonce k values. Observe that approximately 6% of nonces fall outside the valid range [2, q-1] due to the flawed compareTo check.
4. Apply lattice/HNP attack: Feed the collected biased (h, r, s, k) tuples into a lattice-based Hidden Number Problem solver (e.g., using SageMath or a custom implementation) to recover the DSA private key x.
5. Forge signatures: Use the recovered private key to forge arbitrary DSA signatures, impersonate the victim, or decrypt protected data depending on how the key is used in the target application (GitHub Gist).

• Network: Unusually high volume of requests to application endpoints that trigger DSA signing operations from a single source IP, potentially indicative of signature collection for nonce analysis.
• Logs: Application logs showing repeated DSA signing requests with diverse message inputs from the same client; anomalous patterns in authentication or signing API call frequency.
• File System: Presence of files matching the PoC script pattern (jsrsasign_dataset.json, weak_dataset.json) on systems with access to DSA private keys, suggesting local key recovery attempts.
• Process: Execution of Node.js scripts referencing jsrsasign, KJUR.crypto.DSA, or signWithMessageHash in unexpected contexts; presence of poc_collect_jsrsasign_dataset.js or similar scripts on the filesystem (GitHub Gist).

Upgrade jsrsasign to version 11.1.1 or later, which replaces the sentinel-value comparisons (!= -1, == 1) with sign-based comparisons (>= 0, > 0) that are correct regardless of the magnitude returned by compareTo(). The fix was merged in commit ee4b013 via PR #647 on February 20, 2026. Applications using jsrsasign for DSA signing should treat this as a high-priority update; as a temporary measure, consider disabling DSA-based signing operations until the upgrade is applied. Additionally, any signatures generated with affected versions should be considered potentially compromised and reviewed accordingly (GitHub Commit, Snyk Advisory).

The vulnerability was reported by researcher Kr0emer, who provided a detailed root cause analysis and PoC collection script via GitHub Gist, and submitted the fix directly via pull request to the jsrsasign repository. The disclosure was covered by The Hacker Wire and Yazoul.net, and noted in the ENISA European Vulnerability Database (EUVD-2026-14373). Social media discussion appeared on Mastodon and Bluesky, primarily from security community accounts sharing the CVE details. Red Hat tracked the issue in Bugzilla (Bug 2450207) with high severity, though no downstream Red Hat product advisories had been issued at time of publication (Red Hat Bugzilla, GitHub Gist).