Signature Forgery Vulnerability in Node-Forge by Digital Bazaar
CVE-2026-85393

8.7HIGH

Key Information:

Vendor: Digitalbazaar
Status: Forge
Vendor: CVE Published:; 3 September 2026

🔔 Create Digitalbazaar Vulnerability Alert

What is CVE-2026-85393?

The node-forge library, specifically versions up to 1.4.0, contains a vulnerability that fails to validate the element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. This flaw permits attackers to manipulate the DigestAlgorithm sequence by embedding arbitrary garbage bytes, resulting in forged signatures for any message when using low-exponent RSA keys. This issue reflects an incomplete remediation effort for a related vulnerability found in CVE-2026-33894.