CVE-2026-33894
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The node-forge library before version 1.4.0 has a vulnerability in RSASSA PKCS#1 v1.5 signature verification for low public exponent keys (e=3). Attackers can forge signatures by inserting garbage bytes into the ASN structure, enabling Bleichenbacher-style forgery. This issue is similar to CVE-2022-24771 but differs in the location of the inserted bytes.
Risk Assessment
The organization is at risk of accepting forged digital signatures, which could lead to data integrity breaches, impersonation of trusted sources, or attacks on signature-based authentication systems.
Recommendation
Immediately update the node-forge library to version 1.4.0 or later, which contains the fix for this vulnerability.
Other vulnerabilities in node-forge
See all- CVE-2026-33896High
A vulnerability in node-forge before version 1.4.0 allows bypassing RFC 5280 basicConstraints requirements during certificate chain verification. The lack of enforcement enables any leaf certificate (without basicConstraints and keyUsage extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.
- CVE-2026-33895High
The node-forge library before version 1.4.0 accepts non-canonical Ed25519 signatures where the scalar S is not reduced modulo the group order (S >= L). Both a valid signature and its S+L variant are considered valid, while the OpenSSL-backed implementation rejects the S+L variant as per the specification.
- CVE-2026-33891High
A Denial of Service (DoS) vulnerability exists in node-forge before version 1.4.0 due to an infinite loop in the BigInteger.modInverse() function. Calling this function with a zero value causes the process to hang indefinitely and consume 100% CPU.
Original NVD description (English source)
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing “garbage” bytes within the ASN structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN structure, rather than outside of it. Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.