Junglewise Threat Intelligence

CVE-2026-33894: Digital Bazaar node-forge signature forgery in RSASSA PKCS#1 v1.5

CVE-2026-33894 · Severity: high · CVSS 7.5 · Published 2026-03-27

Technologies: Red Hat Developer Hub 1.8, Red Hat Quay 3.12, node-forge (npm), Digital Bazaar Forge, Red Hat Ansible Automation Platform 2.5 for RHEL 8. Vendors: Red Hat, npm, Digital Bazaar.

Executive brief

Forge (node-forge) is a popular JavaScript library used for implementing security protocols like TLS and digital signatures. A vulnerability in its signature verification process allows attackers to bypass security checks by creating forged digital signatures that appear valid. This could allow an attacker to impersonate trusted entities or provide malicious data that the system incorrectly trusts as authentic.

Technical details

Forge (node-forge) prior to version 1.4.0 fails to properly validate the canonical structure of RSASSA PKCS#1 v1.5 signatures. Specifically, the library's signature verification logic accepts forged signatures for keys with a low public exponent (e=3) by allowing 'garbage' bytes to be stuffed within the ASN.1 structure. While the library includes a check to ensure all bytes are consumed during parsing, it does not verify that the resulting structure matches the minimal DigestInfo shape required by RFC 8017. Additionally, the library fails to enforce the minimum 8-byte padding requirement defined in the PKCS#1 specification. These flaws enable Bleichenbacher-style forgery attacks, allowing an attacker to construct a signature that passes verification without possessing the private key. The issue is addressed in version 1.4.0.

Affected products

  • Digital Bazaar node-forge < 1.4.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Quay 3.12

Timeline

  • 2026-03-24: advisory: Vendor advisory published by Digital Bazaar
  • 2026-03-27: disclosed: CVE published to NVD
  • 2026-03-24: patched: Version 1.4.0 released to address the issue

References

Related threats