@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4598 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...

CVE-2026-4598

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values e.g.,...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4598 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4598 Source advisory:...

@atomicservice/ascf-toolkit (>=1.0.0, <=1.0.17), @atomicservice/ascf-toolkit-hvigor-plugin (>=1.0.1-beta.1, <=1.0.17) +77 more potentially affected by CVE-2026-4598 via jsrsasign (>=11.0.0, <=11.1.0)

jsrsasign NPM version =11.0.0, =1.0.0, =1.0.1-beta.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.8.3 - @citrineos/ocpi-base 2.0.1 - @citrineos/ocpi-cdrs 2.0.1 - @citrineos/ocpi-charging-profiles 2.0.1 - @citrineos/ocpi-commands 2.0.1 - @citrineos/ocpi-credentials 2.0.1 - @citrineos/ocpi-locations 2.0.1 -...