Skip to content
fr Sign in
7.5 High

CVE-2026-33895 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript

Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.

Affected products and versions

Product Affected versions Fixed in
forge 1.4 earliest → < 1.4.0 1.4.0
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Developer Hub 1.8 1776784286 earliest → < 1776784286 1776784286
Red Hat Developer Hub 1.9 1777903262 earliest → < 1777903262 1777903262
Logging Subsystem for Red Hat OpenShift Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat Build of Podman Desktop Versions not published
Red Hat Data Grid 8 Versions not published
Show the 10 other branches
Product Affected versions Fixed in
Red Hat Fuse 7 Versions not published
Red Hat Quay 3 Versions not published
Cryostat 4 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Process Automation 7 Versions not published
Cluster Observability Operator 1.5.0 1782839279 earliest → < 1782839279 1782839279

References

Timeline

  1. Published
  2. Last modified

Other CVEs of forge

The 25 CVEs of forge →
CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer 7.5 High CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.4 High CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 5.9 Medium CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.5 High
Track this CVE