RSA signature validation vulnerability on maleable encoded message in jsrsasign

CRITICAL 9.1CVE-2021-30246 · GHSA-27fj-mc8w-j9wg · Published 07/04/2021 · updated 22/06/2026

In short

CVE-2021-30246 is a CRITICAL (CVSS 9.1) vulnerability affecting jsrsasign (kjur), jsrsasign.
Chance of exploitation in the next 30 days (EPSS): 0.96%, higher than 61.6% of all vulnerabilities.
Fix: update to 10.2.0 or later.

Package	Affected versions	Patched versions
jsrsasign kjur	`≤ 10.1.13`	No fix yet
jsrsasign npm	`< 10.2.0`	`10.2.0`

Description

Impact

Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding. Decoded RSA signature value consists following form: 01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo] Its byte length must be the same as RSA key length, however such checking was not sufficient.

To make crafted message for practical attack is very hard.

Patches

Users validating RSA signature should upgrade to 10.2.0 or later.

Workarounds

There is no workaround. Not to use RSA signature validation in jsrsasign.

ACKNOWLEDGEMENT

Thanks to Daniel Yahyazadeh @yahyazadeh for reporting and analyzing this vulnerability.

NVD description

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

References

kjur/jsrsasign security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-30246 · ADVISORY
kjur/jsrsasign · WEB
kjur/jsrsasign release 10.1.13 · WEB
kjur.github.io/jsrsasign · WEB
kjur.github.io/jsrsasign · Release Notes

More vulnerabilities in jsrsasign

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

jsrsasign

kjur

≤ 10.1.13

No fix yet

jsrsasign

npm

< 10.2.0

10.2.0

Description

Impact

To make crafted message for practical attack is very hard.

Patches

Users validating RSA signature should upgrade to 10.2.0 or later.

Workarounds

There is no workaround. Not to use RSA signature validation in jsrsasign.

ACKNOWLEDGEMENT

Thanks to Daniel Yahyazadeh @yahyazadeh for reporting and analyzing this vulnerability.

NVD description

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

More vulnerabilities in jsrsasign

See all →