Security Flaw in Node-Forge Affecting Transport Layer Security Features

CVE-2026-125335

What is CVE-2026-125335?

A vulnerability in Node-Forge prior to version 1.4.3 affects the handling of public keys in the ed25519.verify() method. This flaw allows attackers to exploit small-order points or their non-canonical encodings, potentially enabling them to generate valid signatures for messages without possessing the necessary private key. This issue undermines key security mechanisms such as proof-of-possession, attribution, non-repudiation, and deduplication checks tied to digital signatures. While typical Ed25519 key generation does not result in small-order keys, applications that utilize only trusted or internally-generated public keys remain unaffected. The vulnerability has been successfully addressed in version 1.4.3, protecting against such attacks.

References