UBUNTU-CVE-2026-125335: Medium severity ubuntu/node-node-forge vulnerability
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in cryptosignopen() without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can choose the public key can produce signatures that verify for many messages, or all messages with the identity key, without a private key. This can defeat proof-of-possession, attribution, non-repudiation, or deduplication checks that rely on a signature being bound to the message. Keys produced by normal Ed25519 key generation are not small-order, so applications that verify only trusted or internally generated public keys are not affected. This issue is fixed in version 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications are exposed when they use ed25519.verify() with public keys chosen or supplied by an attacker. Applications that verify only trusted or internally generated public keys are not affected, because normal Ed25519 key generation does not produce small-order keys.
What does an attacker need to exploit this issue?
The attacker needs to be able to choose the public key used for verification. They can then use a signature with S = 0 and a small-order R value to obtain verification for many messages, or for all messages when using the identity key, without possessing a private key.
What security controls can fail if the issue is exploited?
Proof-of-possession, attribution, non-repudiation, and deduplication checks can be defeated when they rely on a signature being bound to the message.
What version fixes the issue?
The issue is fixed in Forge version 1.4.3.