Technical impact
The vulnerability arises from a division by zero error in the RSASetPublic parsing logic and BigInteger.modPowInt reduction used by jsrsasign. An attacker who supplies a JSON Web Key whose modulus decodes to zero can force RSA public‑key operations, such as signature verification and encryption, to produce zero results. The error handling also suppresses the expected “invalid key” message, making detection difficult. This flaw can enable an adversary to bypass cryptographic checks that rely on public‑key verification or to corrupt encrypted data without detection.
Affected Systems
The issue affects the JavaScript library jsrsasign provided by the jsrsasign project, for use in Node.js environments. All package versions released before 11.1.1 are vulnerable; upgrading to 11.1.1 or a later release removes the flaw.
Risk and Exploitability
The vulnerability has a CVSS score of 5.1, indicating medium severity, and an EPSS score of less than 1 %, suggesting low likelihood of exploitation in the near term. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to control the JSON Web Key input supplied to the library, which is typically possible in applications that parse or process JWK data from external sources. No publicly disclosed exploits have been reported, but the deterministic zero output could be leveraged to subvert authentication or data integrity checks.
Github GHSA