CVE-2021-30246

CriticalCVSS 9.1/10Last modified Jun 22, 2026

Description

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Apr 7, 2021
Last modified
Jun 22, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-30258.8Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popCVE-2021-302547.8Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon ComputCVE-2021-302557.8Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnCVE-2021-302567.8Possible stack overflow due to improper validation of camera name length before copying the name in VR Service in Snapdragon Compute, SnapdrCVE-2021-302577.8Possible out of bound read or write in VR service due to lack of validation of DSP selection values in Snapdragon Compute, Snapdragon ConnecCVE-2021-302587.8Possible buffer overflow due to improper size calculation of payload received in VR service in Snapdragon Auto, Snapdragon Compute, SnapdragCVE-2021-302597.8Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectCVE-2021-30266.1Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.CVE-2021-302607.8Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configuratCVE-2021-302617.8Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in SCVE-2021-302627.8Improper validation of a socket state when socket events are being sent to clients can lead to invalid access of memory in Snapdragon Auto, CVE-2021-302637.8Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon
CVE-2021-30246: Critical severity, CVSS 9.1 | Vulnix