CVE-2026-85393 (High) detected in node-forge-1.4.0.tgz

[mend-for-github-com]

CVE-2026-85393 - High Severity Vulnerability

Vulnerable Library - node-forge-1.4.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• request-crypto-2.0.2.tgz (Root Library)
  • node-jose-2.2.0.tgz
    • ❌ node-forge-1.4.0.tgz (Vulnerable Library)

Found in HEAD commit: f64b91690e9e7e87dd07fb0925677f4c6cfd3321

Found in base branch: main

Vulnerability Details

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#⁠1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.

Publish Date: 2026-09-03

URL: CVE-2026-85393

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.