# CVE-2022-24771: node-forge RSA signature forgery in PKCS#1 v1.5 verification

Source: https://junglewise.ai/threats/cve-2022-24771-node-forge-rsa-signature-forgery-in-pkcs-1-v1-5-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-24771 · Severity: low · CVSS 3.1 · Published 2022-03-18

node-forge is a cryptographic library used in web applications to handle digital signatures and encryption. A flaw in RSA signature verification allows attackers to forge valid signatures on arbitrary data when a low public exponent is used, potentially bypassing authentication, tampering with signed messages, or compromising data integrity without detection.

Technologies: [node-forge (npm)](https://junglewise.ai/threats/technologies/node-forge). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-24771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-24771 being exploited in the wild.

**How severe is CVE-2022-24771?** Low severity, with a CVSS score of 3.1, published 18 March 2022.

**Which products and versions are affected?** node-forge (npm) SEMVER:introduced=0,fixed=1.3.0.

**Is there a fix for CVE-2022-24771?** Yes. node-forge (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-24771 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-24771?** Check whether you run node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- node-forge (npm): upgrade to 1.3.0 or later

  ```sh
  npm install node-forge@1.3.0
  ```


## Technical details

The vulnerability is an improper verification of cryptographic signatures (CWE-347) in RSA PKCS#1 v1.5 signature verification. The code is lenient in checking the structure of the digest algorithm identifier, allowing an attacker to craft a malformed PKCS#1 encoded message that steals padding bytes and leaves unchecked portions that can be used to forge a signature. This is a variant of Bleichenbacher's RSA signature forgery attack based on implementation error. The attack requires that the target system uses a low public exponent (typically e=3 or e=65537 with short key lengths) and is reachable over the network. An attacker can forge signatures on any message without knowledge of the private key, compromising the integrity of signed data. The vulnerability was patched in node-forge version 1.3.0.

## Affected products

- Digital Bazaar node-forge < 1.3.0

## Identifiers

- CVE-2022-24771
- GHSA-cfm4-qjh2-4765

## Timeline

- 2022-03-18: disclosed
- 2022-03-18: patched: Version 1.3.0 released

## References

- [https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765](https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765)

## Related threats

- [Forge: Ed25519 signature verification accepts small-order public keys](https://junglewise.ai/threats/cve-2026-125335-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge TLS client crash on handshake record without session](https://junglewise.ai/threats/cve-2026-125334-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge HTTP ReDoS in response header parsing](https://junglewise.ai/threats/cve-2026-125333-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge TLS client crash on unsupported ServerHello compression](https://junglewise.ai/threats/cve-2026-125332-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding](https://junglewise.ai/threats/cve-2026-119192-forge-rsa-pkcs-1-v1-5-signature-forgery-via-non-canonical)