CVE-2026-85393: node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.
Other sources
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to signature forgery?
Deployments using npm/node-forge through version 1.4.0 to verify RSA PKCS#1 v1.5 signatures are affected. Exploitation specifically requires low-exponent RSA keys.
What does an attacker need to exploit this issue?
The attacker can forge signatures for arbitrary messages by placing garbage bytes inside a nested DigestAlgorithm sequence. The vulnerability is remotely exploitable and requires no privileges or user interaction according to the supplied vector.
How can I determine whether this affects my application?
Check whether your application includes node-forge at version 1.4.0 or earlier and uses it for RSA PKCS#1 v1.5 signature verification. Also identify whether the RSA verification keys have a low public exponent.
Is this related to an earlier issue?
Yes. The issue is described as an incomplete fix for CVE-2026-33894.