p PatchFirst

CVE-2021-30246

CVE-2021-30246

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

CVSS 9.1 · Critical · EPSS 1.0% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • jsrsasign npm

    Affected ranges
    • SEMVER: < 10.2.0

    Update to 10.2.0

Original sources

Check your server →