{"action":"Upgrade jsrsasign to 11.1.1 or later.","affected":[{"fixed":"11.1.1","introduced":"0"}],"component":"jsrsasign","cve_ids":["CVE-2026-4603"],"ecosystem":"npm","epss":0.00114,"exploited":false,"fixed_versions":["11.1.1"],"ghsa_id":"GHSA-464q-cqxq-xhgr","id":"tcs_01M5KEZGYQ67YNMFYEXFMFEFSS","modified_at":"2026-03-30T19:56:21.371329Z","published_at":"2026-03-23T06:30:29Z","references":["https://osv.dev/vulnerability/GHSA-464q-cqxq-xhgr","https://nvd.nist.gov/vuln/detail/CVE-2026-4603","https://github.com/kjur/jsrsasign/pull/649","https://github.com/kjur/jsrsasign/commit/dc41d49fac4297e7a737a3ef8ebd0aa9c49ef93f","https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3","https://github.com/kjur/jsrsasign","https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-464q-cqxq-xhgr","url":"https://osv.dev/vulnerability/GHSA-464q-cqxq-xhgr"}],"summary":"jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations"}