Affected versions of this package are vulnerable to Signature Bypass. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.
jsrsasign to version 8.0.18 or higher.