JavaScript Library Vulnerability in Sigstore Services

CVE-2026-48816

What is CVE-2026-48816?

The sigstore-js library, utilized for interacting with Sigstore services, contains an improper input validation issue in versions prior to 3.1.1. In the affected versions, the @sigstore/verify component incorrectly derives a transparency-log timestamp from non-cryptographically bound data in certain inclusion proofs. This flaw allows attackers to submit untrusted bundles that can influence the outcomes of certificate validity checks and timestamp threshold verifications. The vulnerability has been addressed in version 3.1.1, mitigating the risk associated with untrusted inputs.

References