CVE-2026-4603: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4603 is a Division by Zero vulnerability in the jsrsasign JavaScript cryptographic library affecting all versions before 11.1.1. The flaw resides in the RSA public-key parsing path (RSASetPublic/KEYUTIL.getKey() in ext/rsa.js) and the BigInteger.modPowInt reduction logic in ext/jsbn.js, allowing an attacker to supply a JWK whose modulus decodes to zero, causing RSA operations to silently produce deterministic zero outputs. The vulnerability was disclosed on February 21, 2026, published by Snyk on March 22, 2026, and assigned CVE-2026-4603. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.0 (Low) (Snyk Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-369 (Divide By Zero), compounded by CWE-20 (Improper Input Validation). Two independent bugs interact: Bug A — RSASetPublic in ext/rsa.js validates the modulus string only by checking its length (N.length > 0), not its parsed numeric value; a JWK with n set to "AA" (base64url of 0x00) decodes to hex "00", passes the length guard, and is silently stored as BigInteger(0). Bug B — bnpDivRemTo in ext/jsbn.js early-exits without throwing when the divisor has zero internal words (w.t = 0), so modPowInt(e, n=0) returns 0 for all inputs rather than raising an error. Together, these bugs allow any RSA public-key operation (verify, encrypt) to degenerate into a constant function returning zero, while masking the invalid key condition from callers. A detailed PoC and root-cause analysis are publicly available (Kr0emer Gist, GitHub PR #649).

Successful exploitation allows an attacker who can influence the RSA public key consumed by a victim application (e.g., via a JWKS endpoint, embedded JWK in a JWS header, or user-supplied key material) to cause RSA signature verification to return a definitive boolean result (false) without any exception, making it impossible for callers to distinguish a malformed key from a legitimately invalid signature. In encryption contexts, the RSA public-key operation becomes plaintext-independent (constant output of zero), undermining confidentiality guarantees. Additionally, the silent failure mode reduces diagnosability and can enable key-substitution attacks in BYOK or federated identity flows where the signer supplies their own public key (Kr0emer Gist, Snyk Advisory).

A proof-of-concept (PoC) script demonstrating the full attack chain — JWK acceptance, silent mod(0), wrong verify() result, and universality across all inputs — is publicly available as a GitHub Gist authored by the discoverer Kr0emer (Kr0emer Gist). However, analysis by Feedly indicates the PoC is an advisory/analysis document rather than a weaponized exploit payload, and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.008% (2nd percentile), indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA KEV catalog. CVSS v4.0 exploit maturity is rated as Proof of Concept (Snyk Advisory).

1. Identify target: Locate an application that uses jsrsasign (versions < 11.1.1) to import RSA public keys from an external or attacker-influenced source such as a JWKS endpoint, embedded JWK in a JWS/JWT header, or user-supplied key material.
2. Craft malicious JWK: Construct a JWK RSA public key object with the modulus n set to "AA" (the base64url encoding of a single zero byte 0x00) and a standard public exponent e of "AQAB" (65537): { kty: 'RSA', n: 'AA', e: 'AQAB' }.
3. Deliver the malicious JWK: Supply this JWK to the target application via the attack surface (e.g., serve it from an attacker-controlled JWKS URL, inject it into a JWS jwk header, or provide it as a user-supplied public key).
4. Trigger key import: The application calls KEYUTIL.getKey(jwk), which internally calls RSASetPublic(b64utohex('AA'), b64utohex('AQAB')). The hex string '00' passes the length guard (N.length > 0), and parseBigInt('00', 16) silently stores BigInteger(0) as the RSA modulus.
5. Observe silent failure: Any subsequent RSA operation (e.g., Signature.verify()) calls RSADoPublic(x) → x.modPowInt(65537, BigInteger(0)). bnpDivRemTo early-exits with zero, so all inputs produce output 0. verify() returns false without throwing — the caller cannot distinguish a malformed key from a legitimately invalid signature.
6. Exploit in encryption context: If the target uses the imported key for RSA encryption, the ciphertext becomes plaintext-independent (always 0), undermining confidentiality for any data encrypted under the attacker-supplied key (Kr0emer Gist).

• Network: Unexpected or anomalous JWK/JWKS responses containing an RSA key with a very short (1–2 character) n field (e.g., "n": "AA"); requests to attacker-controlled JWKS endpoints substituted for legitimate ones.
• Application Logs: RSA signature verification consistently returning false for all inputs without any Invalid RSA public key exception (pre-patch behavior); absence of key validation errors when processing externally sourced JWKs.
• File System / Configuration: JWK or JWKS configuration files containing RSA keys with a modulus value that base64url-decodes to zero or near-zero; n field values of "AA", "AAA", or similar minimal encodings.
• Process / Runtime: Node.js applications using jsrsasign versions < 11.1.1 that accept JWK input from external sources without independent modulus validation; observable via npm list jsrsasign returning a version below 11.1.1 (Kr0emer Gist, Snyk Advisory).

The primary remediation is to upgrade jsrsasign to version 11.1.1 or later, which hardens RSASetPublic in ext/rsa.js to reject moduli ≤ 1 and invalid exponents after parsing, and modifies bnpDivRemTo in ext/jsbn.js to throw "BigInteger divide by zero" instead of silently returning zero (GitHub Commit, GitHub PR #649). As a workaround for applications that cannot immediately upgrade, implement independent input validation to reject any JWK whose n parameter base64url-decodes to a zero or near-zero value before passing it to jsrsasign. Additionally, restrict the sources from which RSA public keys are accepted (e.g., pin JWKS URLs, validate key material against a trusted allowlist) to reduce the attack surface (Snyk Advisory).

The vulnerability was discovered and reported by researcher Kr0emer, who also authored the fix (PR #649) and the public PoC/analysis gist. Snyk assigned and published the CVE, rating it Medium severity. Red Hat opened a tracking bug (BZ#2450205) and ENISA registered it as EUVD-2026-14380. Community reaction has been limited, consistent with the low EPSS score and absence of confirmed exploitation; a Bluesky post from a CVE tracking account noted the disclosure shortly after publication (Snyk Advisory, Red Hat Bugzilla, GitHub PR #649).