CVE-2026-33895
published 2026-03-27CVE-2026-33895: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.35%
27.1th percentile
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| digitalbazaar | forge | <= 1.3.3 | — |
| stablelib | ed25519 | 0 – 2.0.2 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
ghsa7.5HIGH
osv7.5HIGH
vendor_redhat7.9HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
digitalbazaar forge 1.3.2 Ed25519 Signature signature verification (Nessus ID 304110 / WID-SEC-2026-1407)
vuldb·2026-06-20·CVSS 7.5
CVE-2026-33895 [HIGH] digitalbazaar forge 1.3.2 Ed25519 Signature signature verification (Nessus ID 304110 / WID-SEC-2026-1407)
A vulnerability has been found in digitalbazaar forge 1.3.2 and classified as problematic. Affected is an unknown function of the component Ed25519 Signature Handler. The manipulation leads to improper verification of cryptographic signature.
This vulnerability is referenced as CVE-2026-33895. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
OSV
StableLib Ed25519 Signature Malleability via Missing S < L Check
osv·2026-04-01·CVSS 7.5
[HIGH] StableLib Ed25519 Signature Malleability via Missing S < L Check
StableLib Ed25519 Signature Malleability via Missing S = L` to prevent signature malleability.
When `S >= L`, `[S]B = [(S mod L)]B = [(S - L)]B`, meaning two different 32-byte `S` values produce the same verification result. An attacker who observes a valid signature `(R, S)` can produce a second valid signature `(R, S + L)` for the same message.
### Vulnerable code
**File:** `packages/ed25519/ed25519.ts` (compiled: `lib/ed25519.js:779-802`)
```javascript
export function verify(publicKey, message, signature) {
// ... length check, unpack public key ...
const hs = new SHA512();
hs.update(signature.subarray(0, 32)); // R
hs.update(publicKey); // A
hs.update(message); // M
const h = hs.digest();
reduce(h); // h is reduced mod L
scalarmult(p, q, h); // [h](-A)
scalarbase(q, signature.subar
GHSA
StableLib Ed25519 Signature Malleability via Missing S < L Check
ghsa·2026-04-01·CVSS 7.5
[HIGH] CWE-347 StableLib Ed25519 Signature Malleability via Missing S < L Check
StableLib Ed25519 Signature Malleability via Missing S = L` to prevent signature malleability.
When `S >= L`, `[S]B = [(S mod L)]B = [(S - L)]B`, meaning two different 32-byte `S` values produce the same verification result. An attacker who observes a valid signature `(R, S)` can produce a second valid signature `(R, S + L)` for the same message.
### Vulnerable code
**File:** `packages/ed25519/ed25519.ts` (compiled: `lib/ed25519.js:779-802`)
```javascript
export function verify(publicKey, message, signature) {
// ... length check, unpack public key ...
const hs = new SHA512();
hs.update(signature.subarray(0, 32)); // R
hs.update(publicKey); // A
hs.update(message); // M
const h = hs.digest();
reduce(h); // h is reduced mod L
scalarmult(p, q, h); // [h](-A)
scalarbase(q, signature.subar
OSV
CVE-2026-33895: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
osv·2026-03-27·CVSS 6.5
CVE-2026-33895 [MEDIUM] CVE-2026-33895: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.
OSV
Forge has signature forgery in Ed25519 due to missing S > L check
osv·2026-03-26·CVSS 6.5
CVE-2026-33895 [MEDIUM] Forge has signature forgery in Ed25519 due to missing S > L check
Forge has signature forgery in Ed25519 due to missing S > L check
## Summary
Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, [as defined by the specification](https://datatracker.ietf.org/doc/html/rfc8032#section-8.4). This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see [CVE-2026-25793](https://nvd.nist.gov/vuln/detail/CVE-2026-25793), [CVE-2022-35961](https://nvd.nist.gov/vuln/detail/CVE-2022-35961)). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracki
GHSA
Forge has signature forgery in Ed25519 due to missing S > L check
ghsa·2026-03-26·CVSS 6.5
CVE-2026-33895 [MEDIUM] CWE-347 Forge has signature forgery in Ed25519 due to missing S > L check
Forge has signature forgery in Ed25519 due to missing S > L check
## Summary
Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, [as defined by the specification](https://datatracker.ietf.org/doc/html/rfc8032#section-8.4). This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see [CVE-2026-25793](https://nvd.nist.gov/vuln/detail/CVE-2026-25793), [CVE-2022-35961](https://nvd.nist.gov/vuln/detail/CVE-2022-35961)). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracki
Red Hat
node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
vendor_redhat·2026-03-27·CVSS 7.9
CVE-2026-33895 [HIGH] CWE-347 node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicali
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
blogs_hackernews·2026-07-20·CVSS 5.9
CVE-2026-63030 [MEDIUM] ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools.
The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch.
Here is the full recap of what broke, what was exploited, and what needs attention now.
## ⚡ Threat of the Week
New wp2shell WordPress Core Flaw Lets Unauthe
Wiz
CVE-2026-33895 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-33895 [HIGH] CVE-2026-33895 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33895 :
JavaScript vulnerability analysis and mitigation
node-forge
S >= L
S + L
crypto.verify
S + L
Source : NVD
## 7.5
Score
Published March 27, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
JavaScript
Grafana
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.9
Exploitation Probability (EPSS) N/A
Affected packages and libraries
argo-workflows-3.7
argo-workflows-fips-3.6
Sources
NVD
Chainguard Has Fix Added at: Apr 02, 2026
npm Severity HIGH Has Fix Added at: Mar 29, 2026
MinimOS Severity HIGH Has Fix Added at: Apr 05, 2026
Red Hat 8, 9, 10 Severity HIGH No Fix Added at: Mar 29, 2026
Wolfi Has Fix Added at: Apr 02, 2026
## Get a CVE risk assessme
Wiz
GHSA-x3ff-w252-2g7j Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
[HIGH] GHSA-x3ff-w252-2g7j Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-x3ff-w252-2g7j :
JavaScript vulnerability analysis and mitigation
## Ed25519 Signature Malleability via Missing S = L
S >= L
[S]B = [(S mod L)]B = [(S - L)]B
S
(R, S)
(R, S + L)
## Vulnerable code
packages/ed25519/ed25519.ts
lib/ed25519.js:779-802
export function verify(publicKey, message, signature) {
// ... length check, unpack public key ...
const hs = new SHA512();
hs.update(signature.subarray(0, 32)); // R
hs.update(publicKey); // A
hs.update(message); // M
const h = hs.digest();
reduce(h); // h is reduced mod L
scalarmult(p, q, h); // [h](-A)
scalarbase(q, signature.subarray(32)); // [S]B -- S NOT checked or reduced
edadd(p, q);
pack(t, p);
if (verify32(signature, t)) { // compare R
return false;
}
return true;
}
h
reduce()
S
scalarbase()
## Proof of Concep
Bugzilla
CVE-2026-33895 fbthrift: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [fedora-all]
bugzilla·2026-03-27·CVSS 7.5
CVE-2026-33895 [HIGH] CVE-2026-33895 fbthrift: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [fedora-all]
CVE-2026-33895 fbthrift: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This project only ships JavaScript code as part of the website, the files are not shipped in the binary RPMs
Bugzilla
CVE-2026-33895 cachelib: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [fedora-all]
bugzilla·2026-03-27·CVSS 7.5
CVE-2026-33895 [HIGH] CVE-2026-33895 cachelib: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [fedora-all]
CVE-2026-33895 cachelib: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This project only ships JavaScript code as part of the website, the files are not shipped in the binary RPMs
Bugzilla
CVE-2026-33895 cachelib: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [epel-all]
bugzilla·2026-03-27·CVSS 7.5
CVE-2026-33895 [HIGH] CVE-2026-33895 cachelib: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [epel-all]
CVE-2026-33895 cachelib: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This project only ships JavaScript code as part of the website, the files are not shipped in the binary RPMs
Bugzilla
CVE-2026-33895 fbthrift: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [epel-all]
bugzilla·2026-03-27·CVSS 7.5
CVE-2026-33895 [HIGH] CVE-2026-33895 fbthrift: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [epel-all]
CVE-2026-33895 fbthrift: Forge: Authentication bypass via forged Ed25519 cryptographic signatures [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This project only ships JavaScript code as part of the website, the files are not shipped in the binary RPMs
Bugzilla
CVE-2026-33895 node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
bugzilla·2026-03-27·CVSS 6.5
CVE-2026-33895 [MEDIUM] CVE-2026-33895 node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
CVE-2026-33895 node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-ob
https://datatracker.ietf.org/doc/html/rfc8032#section-8.4https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rwhttps://access.redhat.com/errata/RHSA-2026:13826https://access.redhat.com/errata/RHSA-2026:24761https://access.redhat.com/errata/RHSA-2026:34342https://access.redhat.com/errata/RHSA-2026:9742https://access.redhat.com/security/cve/CVE-2026-33895https://bugzilla.redhat.com/show_bug.cgi?id=2452457https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rwhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33895.json
2026-03-27
Published