CVE-2026-4599

CVE-2026-4599 is a critical vulnerability affecting jsrsasign package versions 7.0.0 through 11.1.1, where incomplete comparison logic in its random number generation functions leads to biased DSA nonces. This flaw allows a remote, unauthenticated attacker to recover private keys during signature generation. With a CVSS score of 9.1 Critical, the vulnerability presents a significant risk to confidentiality and integrity due to its low attack complexity. Although there is no evidence of active exploitation or public exploit code, the issue has received community attention, urging immediate patching.