Question 1

What is CVE-2021-30246 — CVE-2021-30246?

Accepted Answer

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.

Question 2

What is the authoritative source for CVE-2021-30246?

Accepted Answer

CVE-2021-30246 (CVE-2021-30246) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVSS	9.1 ()
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Last modified	2026-06-22

CVE-2021-30246CVE-2021-30246

Description

Scoring