CVE-2026-4601: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4601 is a Missing Cryptographic Step vulnerability (CWE-325) in the jsrsasign JavaScript cryptographic library affecting all versions before 11.1.1. The flaw exists in the KJUR.crypto.DSA.signWithMessageHash function of the DSA signing implementation, where the library fails to check whether computed signature components r or s are zero before emitting a signature — a requirement mandated by FIPS 186-4 §4.6. An attacker who can force or observe an s=0 signature can algebraically recover the DSA private key. It was disclosed on March 23, 2026, with a CVSS v3.1 base score of 9.1 (Critical) (Snyk Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-325 (Missing Required Cryptographic Step). In KJUR.crypto.DSA.signWithMessageHash, after computing r = (g^k mod p) mod q and s = k⁻¹(H(m) + x·r) mod q, the function returns the signature without verifying that neither r nor s equals zero — a mandatory check per FIPS 186-4 §4.6 steps 5 and 7, which require re-selecting the ephemeral key k and retrying if either value is zero. If s = 0, the equation s = k⁻¹(H(m) + x·r) mod q = 0 implies H(m) + x·r ≡ 0 (mod q), allowing any observer to recover the private key x via x = -H(m) · r⁻¹ mod q. While the natural probability of s = 0 for a random message is approximately 1/q ≈ 2⁻¹⁶⁰, an attacker with control over the ephemeral key k or the message hash can deliberately trigger this condition (GitHub Gist PoC, GitHub PR #645).

Successful exploitation allows an unauthenticated network attacker to recover the DSA private key used by any application relying on jsrsasign for DSA signing operations. With the recovered private key, an attacker can forge arbitrary signatures, impersonate the affected application or service, and undermine the integrity of any authentication or code-signing mechanism that depends on the compromised key. Both confidentiality (private key exposure) and integrity (signature forgery) are critically impacted, while availability is unaffected (Snyk Advisory, Red Hat Bugzilla).

A public proof-of-concept exploit is available as a GitHub Gist authored by researcher Kr0emer, demonstrating private key recovery by forcing a specific ephemeral k value and crafting a message hash to produce s=0 (GitHub Gist PoC). The CVSS v4.0 exploit maturity is rated "Proof of Concept." There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.021% (8th percentile), indicating low current exploitation probability (Snyk Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate applications using jsrsasign versions prior to 11.1.1 for DSA signing operations (e.g., via npm dependency audits, Snyk scans, or Qualys detection ID 5009997).
2. Understand the signing context: Determine whether the target application exposes DSA-signed outputs (e.g., signed tokens, certificates, or messages) that can be observed or influenced by an attacker.
3. Force or observe a zero-s signature: If the attacker controls the message input or the ephemeral key k (e.g., via a weak RNG or by crafting a specific message hash), select k and compute a message hash H(m) such that H(m) + x·r ≡ 0 (mod q), causing s = 0. The vulnerable library will emit this invalid signature without retrying.
4. Recover the private key: From the observed signature (r, 0) and the known message hash H(m), compute the private key: x = -H(m) · r⁻¹ mod q.
5. Forge signatures: Use the recovered private key x to sign arbitrary messages, impersonating the legitimate application or bypassing signature-based authentication (GitHub Gist PoC, GitHub PR #645).

• Application Behavior: DSA signatures produced by the application where the s component equals zero (detectable by parsing ASN.1 signature output and checking s value).
• Logs: Application or cryptographic audit logs showing repeated or unusual DSA signing operations, particularly with identical or crafted message hashes.
• Dependency Audit: Presence of jsrsasign npm package versions prior to 11.1.1 in package.json or package-lock.json (detectable via npm audit or Qualys detection ID 5009997).
• Network: Unexpected or anomalous signed tokens/messages in transit that fail standard DSA signature validation (s=0 signatures are cryptographically invalid and should be rejected by compliant verifiers).

Upgrade jsrsasign to version 11.1.1 or later, which adds a FIPS 186-4-compliant retry loop in signWithMessageHash to regenerate the ephemeral key k whenever r or s equals zero (GitHub Commit, GitHub PR #645). There is no known configuration-based workaround; upgrading is the only remediation. Additionally, organizations should audit any DSA keys used with affected versions for potential compromise and consider rotating DSA keys and invalidating signatures generated by vulnerable versions in security-critical systems (Snyk Advisory).

The vulnerability was discovered and responsibly disclosed by researcher Kr0emer, who submitted both the PoC and the fix via GitHub PR #645, which was merged by the jsrsasign maintainer (kjur) on February 20, 2026 (GitHub PR #645). Snyk published an advisory classifying the issue as Critical and noted the availability of a proof-of-concept exploit (Snyk Advisory). Red Hat tracked the issue via Bugzilla with high severity, and coverage appeared on The Hacker Wire and other security news outlets shortly after public disclosure (Red Hat Bugzilla).