Digitalbazaar
Monthly
RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to craft signatures that pass verification against arbitrary messages when the verifying party uses low-exponent RSA keys (e=3). The root cause is missing element-count validation inside nested DigestAlgorithm ASN.1 sequences: forge's `_parseAllDigestBytes` mode confirms all bytes are consumed but does not enforce the canonical minimal DigestInfo shape required by RFC 8017, allowing garbage bytes inside the DigestAlgorithm container to survive verification while OpenSSL rejects the same structure. This is explicitly described as an incomplete fix for CVE-2026-33894; a working proof-of-concept is documented in the linked GHSA advisory; no public exploit identified in CISA KEV at time of analysis.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to craft signatures that pass verification against arbitrary messages when the verifying party uses low-exponent RSA keys (e=3). The root cause is missing element-count validation inside nested DigestAlgorithm ASN.1 sequences: forge's `_parseAllDigestBytes` mode confirms all bytes are consumed but does not enforce the canonical minimal DigestInfo shape required by RFC 8017, allowing garbage bytes inside the DigestAlgorithm container to survive verification while OpenSSL rejects the same structure. This is explicitly described as an incomplete fix for CVE-2026-33894; a working proof-of-concept is documented in the linked GHSA advisory; no public exploit identified in CISA KEV at time of analysis.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.