Technical impact
The bnModInverse function in the jsrsasign cryptographic library enters an infinite loop when its modulus argument is zero or negative. This causes the JavaScript event loop to stall, permanently hanging the Node.js process and preventing any new requests from being served. The underlying weakness is an infinite-loop bug (CWE‑835) combined with inadequate input validation (CWE‑1287).
Affected Systems
Any Node.js application that uses jsrsasign version 11.0.x or earlier is affected. The library is commonly included for JSON Web Token processing, RSA signature generation, and other cryptographic operations. The package’s CPE indicates deployment within the Node.js runtime, and the vendor is the jsrsasign_project organization. Upgrading to version 11.1.1 or later resolves the vulnerability by adding guard clauses against zero or negative modulus inputs.
Risk and Exploitability
The CVSS score of 8.7 marks this issue as high severity, while the EPSS score of less than 1% suggests the vulnerability has not yet attracted widespread exploitation; it is also not listed in the CISA KEV catalog. The likely attack vector is through any payloads or API endpoints that allow attackers to supply numeric values to jsrsasign routines, such as malicious JWT claims or user-controlled integers. By invoking modInverse(0, m) or modInverse(-1, m), the attacker can trigger the infinite loop and cause a denial of service. The risk is system-wide availability disruption until the affected process is restarted.
Github GHSA