node-forge signature verification bypass flaws
Two node-forge vulnerabilities let attackers forge RSA and Ed25519 signatures, undermining authentication and code-signing checks in affected apps.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Digital Bazaar's node-forge, a widely used JavaScript cryptographic library, contains two distinct signature verification flaws. CVE-2026-33894 affects RSA PKCS#1 v1.5 verification by accepting non-canonical ASN.1 DigestInfo encodings and undersized padding, allowing forged signatures particularly against low public exponent keys like e=3. CVE-2026-33895 affects Ed25519 verification by failing to enforce scalar canonicality per RFC 8032, permitting signature mutation via S' = S + k·L that still validates successfully.
Both flaws stem from insufficient enforcement of canonical cryptographic structures, causing node-forge to accept signatures that standard implementations like OpenSSL and Node.js native crypto correctly reject. The issues exist in default configurations with no special flags required, and public proofs of concept exist demonstrating both RSA forgery and Ed25519 scalar manipulation over the network. Impact is broad since node-forge underpins JOSE libraries such as node-jose, certificate tooling from Adobe and Expo, and custom PKI integrations, potentially affecting authentication, code-signing, and token-binding workflows wherever node-forge is the sole verification engine.
Both vulnerabilities are fixed in node-forge v1.4.0, released 2026-04-05, which enforces strict canonical validation for both RSA and Ed25519 verification. Interim mitigations include auditing verification call sites, falling back to Node.js native crypto.verify() for high-assurance flows, and implementing cross-library verification as a secondary check. The vulnerabilities were discovered by researchers at UC Berkeley as part of an academic security project; there is no indication of active exploitation in the wild.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/725167
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs