CVE-2022-24771 — Improper Verification of Cryptographic Signature in Forge

CWE-347 — Improper Verification of Cryptographic Signature CWE-20 — Improper Input Validation11 documents5 sources

Severity

7.5HIGHNVD

EPSS

0.1%

top 67.25%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Digitalbazaar Forge Debian Node-node-forge

Timeline

PublishedMar 18

Latest updateMar 27

Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known work…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5digitalbazaar/forge< 1.4.0

▶NVDdigitalbazaar/forge< 1.3.0

▶debiandebian/node-node-forge< node-node-forge 0.10.0~dfsg-3+deb11u1 (bullseye)

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

CVE-2026-33894: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript↗2026-03-27

▶

OSV

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field↗2026-03-26

▶

GHSA

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field↗2026-03-26

▶

GHSA

Improper Verification of Cryptographic Signature in node-forge↗2022-03-18

▶

OSV

CVE-2022-24771: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript↗2022-03-18

▶

📋Vendor Advisories

Red Hat

node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification↗2026-03-27

▶

Red Hat

node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery↗2022-03-18

▶

Debian

CVE-2022-24771: node-node-forge - Forge (also called `node-forge`) is a native implementation of Transport Layer S...↗2022

▶