AIKIDO-2026-10969
node-rsa is vulnerable to Side-channel Attack
75
High Risk
This Affects:
node-rsaTL;DR
The node-rsa library performs RSA encryption, decryption, signing, and verification in JavaScript for Node.js and browser environments. Before the fix, PKCS#1 v1.5 decryption, OAEP decoding, PSS verification, and unblinded private RSA operations leaked timing information that a remote attacker can measure to recover plaintext or private key material. Miller-Rabin primality testing used predictable witnesses, imported CRT private key components were not cross-checked, and several key-import parsers lacked strict validation. The patch rewrites these code paths with constant-time decoding, RSA blinding, CSPRNG-based primality tests, CRT consistency checks, and hardened PKCS#8 and OpenSSH parsing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
node-rsa is vulnerable to Side-channel Attack in versions 0.0.1 - 1.1.1.
How to fix this
Upgrade the node-rsa library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.