node-forge signature verification bypass flaws

Two node-forge vulnerabilities let attackers forge RSA and Ed25519 signatures, undermining authentication and code-signing checks in affected apps.

Digital Bazaar's node-forge, a widely used JavaScript cryptographic library, contains two distinct signature verification flaws. CVE-2026-33894 affects RSA PKCS#1 v1.5 verification by accepting non-canonical ASN.1 DigestInfo encodings and undersized padding, allowing forged signatures particularly against low public exponent keys like e=3. CVE-2026-33895 affects Ed25519 verification by failing to enforce scalar canonicality per RFC 8032, permitting signature mutation via S' = S + k·L that still validates successfully.

Both flaws stem from insufficient enforcement of canonical cryptographic structures, causing node-forge to accept signatures that standard implementations like OpenSSL and Node.js native crypto correctly reject. The issues exist in default configurations with no special flags required, and public proofs of concept exist demonstrating both RSA forgery and Ed25519 scalar manipulation over the network. Impact is broad since node-forge underpins JOSE libraries such as node-jose, certificate tooling from Adobe and Expo, and custom PKI integrations, potentially affecting authentication, code-signing, and token-binding workflows wherever node-forge is the sole verification engine.

Both vulnerabilities are fixed in node-forge v1.4.0, released 2026-04-05, which enforces strict canonical validation for both RSA and Ed25519 verification. Interim mitigations include auditing verification call sites, falling back to Node.js native crypto.verify() for high-assurance flows, and implementing cross-library verification as a secondary check. The vulnerabilities were discovered by researchers at UC Berkeley as part of an academic security project; there is no indication of active exploitation in the wild.

Source reporting: https://kb.cert.org/vuls/id/725167