Improper Verification of Cryptographic Signature in node-forge (GHSA-cfm4-qjh2-4765)

Description

RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.0
• Patched version(s): 1.3.0

References

• GHSA-cfm4-qjh2-4765
• CVE-2022-24771
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• Prototype Pollution in node-forge - CVE-2020-7720
• Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
• DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS - Vulnerability

Tags:

npm

node-forge