Signature Forgery Vulnerability in Forge by Digital Bazaar

CVE-2026-33894

What is CVE-2026-33894?

The Forge library, a JavaScript implementation of Transport Layer Security, is vulnerable to signature forgery prior to version 1.4.0. Attackers can exploit this vulnerability by utilizing low public exponent keys (e=3). By injecting 'garbage' bytes within the ASN structure, they can create forged signatures that incorrectly pass verification. This issue, while similar to earlier vulnerabilities, specifically allows attackers to manipulate an additional field in the ASN structure, bypassing signature validation mechanisms. The vulnerability is exacerbated by the absence of a check for a minimum padding of 8 bytes, as outlined by specifications, granting further opportunity for signature forgery. Version 1.4.0 addresses and patches this critical issue.

References