Executive brief
node-forge is a JavaScript cryptography library used to verify digital signatures on documents and communications. A flaw in RSA signature verification allows attackers to forge valid signatures for arbitrary messages when using low-exponent RSA keys (exponent=3), bypassing security checks that would be caught by standard cryptographic implementations like OpenSSL. This could enable unauthorized access to signed documents or impersonation of legitimate signers.
Technical details
The vulnerability exists in node-forge's RSA PKCS#1 v1.5 signature verification logic (lib/rsa.js). The _parseAllDigestBytes option guarantees all ASN.1 bytes are parsed but does not enforce that the parsed structure matches the minimal canonical DigestInfo shape required by RFC 8017. Attackers can embed attacker-controlled additional ASN.1 content (garbage bytes) within the DigestAlgorithm sequence to construct forged signatures that pass forge verification but fail OpenSSL verification. Additionally, forge does not validate the minimum 8 bytes of padding (PS) specified in PKCS#1 v1.5, further reducing the difficulty of constructing Bleichenbacher-style forgeries. The issue is triggered when verifying signatures with default scheme (RSASSA-PKCS1-v1_5) on low-exponent RSA keys; no user interaction or authentication is required.
Affected products
- Digital Bazaar node-forge through 1.4.0
Timeline
- 2026-09-03: disclosed