CVE-2021-30246

CriticalCVSS 9.1

Published: 07/04/2021(UTC)Updated: 22/06/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.96%

57th percentile - higher than 57% of all known CVEs

Summary

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. There is no known practical attack exploiting this vulnerability.

Risk Assessment

The organization may be exposed to false positive signature verification results, potentially leading to unauthorized access or data manipulation.

Recommendation

It is recommended to update the jsrsasign package to the latest version to mitigate this vulnerability.

Original NVD description (English source)

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.