REDHAT-BUG-2452464: High severity npm/node-forge vulnerability

Q: What conditions are required for an attacker to forge a signature?

The vulnerable verification path must be used with an RSA public key whose exponent is 3. An attacker can then craft a malformed RSASSA PKCS#1 v1.5 signature containing garbage bytes in the ASN structure and potentially exploit insufficient padding validation.

Q: Which versions are affected and what version fixes the issue?

Versions prior to 1.4.0 are affected. Version 1.4.0 patches the signature-verification flaw.

Q: What should teams prioritize when triaging exposure?

Prioritize applications that use node-forge to verify RSASSA PKCS#1 v1.5 signatures, especially where verification keys have public exponent e=3. The issue affects signature verification rather than signature generation.

Published Mar 27, 2026

Updated

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing “garbage” bytes within the ASN structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN structure, rather than outside of it. Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.

Affected Software

1 affected component

npm/node-forge<1.4.0

Event History

Mar 27, 2026

Data Sourced

via Red Hat·09:03 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for an attacker to forge a signature?

The vulnerable verification path must be used with an RSA public key whose exponent is 3. An attacker can then craft a malformed RSASSA PKCS#1 v1.5 signature containing garbage bytes in the ASN structure and potentially exploit insufficient padding validation.

Which versions are affected and what version fixes the issue?

Versions prior to 1.4.0 are affected. Version 1.4.0 patches the signature-verification flaw.

What should teams prioritize when triaging exposure?

Prioritize applications that use node-forge to verify RSASSA PKCS#1 v1.5 signatures, especially where verification keys have public exponent e=3. The issue affects signature verification rather than signature generation.

REDHAT-BUG-2452464: High severity npm/node-forge vulnerability

Affected Software

Event History

Frequently Asked Questions

What conditions are required for an attacker to forge a signature?

Which versions are affected and what version fixes the issue?

What should teams prioritize when triaging exposure?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for an attacker to forge a signature?

Which versions are affected and what version fixes the issue?

What should teams prioritize when triaging exposure?