8.7
Élevée
CVE-2026-85393 node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5…
Description
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| forge 1.4 | premières → 1.4.0 | Pas de correctif indiqué |
Références
- GitHub Issue #1149 github.com
- github.com github.com
- github.com github.com
- github.com github.com
- GitHub Security Advisory (GHSA-ppp5-5v6c-4jwp) github.com
- VulnCheck Advisory: node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de forge
Les 25 CVE de forge →
CVE-2026-119191
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
Élevée
CVE-2026-119190
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
7.4
Élevée
CVE-2026-119189
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
5.9
Moyenne
CVE-2026-119188
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
7.5
Élevée