{"id":"CVE-2026-33895","published":"2026-03-27T20:47:54Z","modified":"2026-09-04T12:04:49Z","title":"Forge has signature forgery in Ed25519 due to missing S > L check","vendor":"digitalbazaar","product":"forge","tier":"tail","description":{"text":"Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00527,"percentile":0.44473,"provenance":"source"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85","tags":["x_refsource_MISC"]},{"url":"https://datatracker.ietf.org/doc/html/rfc8032#section-8.4","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33895","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452457","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33895.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24761","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":14.1,"factors":[{"name":"EPSS percentile","points":8.89},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"digitalbazaar","affectedVersions":[{"vendor":"digitalbazaar","product":"forge","versions":["< 1.4.0"]}],"affected":[{"ecosystem":"npm","package":"node-forge","vulnerableRanges":["<1.4.0"],"patched":["1.4.0"],"from":["GHSA-q67f-28xg-22rw"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-16835","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-openzeppelin-contracts-cve-2022-35961","parents":[{"from":"CVE-2022-35961","to":"CVE-2026-33895","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-q67f-28xg-22rw","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35961"}]},{"from":"CVE-2026-25793","to":"CVE-2026-33895","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-q67f-28xg-22rw","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25793"}]}]}}