Signature Malleability Flaw in Node-Forge Library

CVE-2026-33895

What is CVE-2026-33895?

The Node-Forge library, a native TLS implementation in JavaScript, contains a vulnerability that allows Ed25519 signature verification to accept non-canonical signatures. Specifically, prior to version 1.4.0, a signature with the scalar S not reduced modulo the group order could be forged. This issue leads to potential bypasses in authentication and authorization processes, as valid signatures and their S + L variants can both be accepted, contrary to expected behavior. This vulnerability can compromise systems that depend on signature uniqueness for essential security functions. The issue has been addressed in version 1.4.0.

References