Vulnerability in Transport Layer Security Implementation in Forge by Digital Bazaar

CVE-2026-118774

What is CVE-2026-118774?

The Forge library, an implementation of Transport Layer Security in JavaScript, has encountered a significant vulnerability related to how it verifies RSA padding and RSASSA-PSS parameters. Prior to version 1.4.1, the library selected these parameters from the issuer certificate instead of the child certificate needing verification. This design flaw could allow a child certificate labeled as RSASSA-PSS to be erroneously validated with a PKCS#1 v1.5 signature, should the issuer employ the same older signing method. Although it does not enable identity forgery, this oversight may lead to potential policy breaches that specify particular signature schemes. The issue has been addressed in version 1.4.1 of the Forge library.

References