Skip to content
fr Sign in
7.5 High

CVE-2026-33894 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript

Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing “garbage” bytes within the ASN structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN structure, rather than outside of it. Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.

Affected products and versions

Product Affected versions Fixed in
forge 1.4 earliest → < 1.4.0 1.4.0
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Developer Hub 1.8 1776784286 earliest → < 1776784286 1776784286
Red Hat Developer Hub 1.9 1777903262 earliest → < 1777903262 1777903262
Red Hat Quay 3.12 1779811412 earliest → < 1779811412 1779811412
Red Hat Quay 3.14 1779689392 earliest → < 1779689392 1779689392
Red Hat Quay 3.15 1780891395 earliest → < 1780891395 1780891395
Red Hat Quay 3.16 1779204086 earliest → < 1779204086 1779204086
Show the 17 other branches
Product Affected versions Fixed in
Red Hat Quay 3.17 1779922205 earliest → < 1779922205 1779922205
Red Hat Quay 3.1 1779822261 earliest → < 1779822261 1779822261
Red Hat Quay 3.9 1779811473 earliest → < 1779811473 1779811473
Logging Subsystem for Red Hat OpenShift Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat Build of Podman Desktop Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Cryostat 4 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Quay 3.10 1779822261 earliest → < 1779822261 1779822261
Cluster Observability Operator 1.5.0 1782839279 earliest → < 1782839279 1782839279

References

Timeline

  1. Published
  2. Last modified

Other CVEs of forge

The 25 CVEs of forge →
CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer 7.5 High CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.4 High CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 5.9 Medium CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.5 High
Track this CVE