sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

Description

The documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked.

Recommendation

Update the sigstore package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.1.0
• Patched version(s): 4.1.1

References

• GHSA-52v5-jr5w-gjxr
• CVE-2026-48815
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` - CVE-2026-47200
• Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code - CVE-2026-33943
• OneUptime has WhatsApp Resend Verification Authorization Bypass - CVE-2026-30959
• Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS - CVE-2026-41150

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

sigstore