GHSA-h87q-g2wp-47pj
Signatures are mistakenly recognized to be valid in jsrsasign
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
What each source reports
GitHub AdvisoriesNo score
Signatures are mistakenly recognized to be valid in jsrsasign
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
- Record
GHSA-h87q-g2wp-47pj- Weakness
- CWE-347
- Updated
- 2026-11-02
OSVNo score
Signatures are mistakenly recognized to be valid in jsrsasign
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
- Record
GHSA-h87q-g2wp-47pj- Weakness
- CWE-347
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jsrsasignnpm | before 10.2.0 | 10.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-h87q-g2wp-47pj is a vulnerability with no CVSS score yet in jsrsasign, published February 9, 2022. No source lists public exploit code. Fixed in jsrsasign 10.2.0.