Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-27 | 1 | Disclosure1 |
| 2026-03-28 | 1 | Disclosure1 |
| 2026-07-16 | 1 | Disclosure1 |
| 2026-08-25 | 1 | Patch1 |
CVE-2026-33894 and CVE-2026-33895 allow RSA-PKCS v1.5 and Ed25519 signature forgery in node-forge v0.1.2 through v1.3.3, with public PoCs already available. #DFIR_Radar https://t.co/RoRjgrLYuO
Post summary
The tweet announces that CVE‑2026‑33894 and CVE‑2026‑33895 allow signature forgery in node‑forge and that public PoCs exist; no exploitation or patch info is mentioned.
CVE-2026-33895: node-forge Signature Verification Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04vggT_0
Post summary
The article highlights the node‑forge Signature Verification bug (CVE‑2026‑33895), explaining its business impact and outlining mitigation steps, including suggested patches or workarounds.
CVE-2026-33895 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts … https://www.cve.org/CVERecord?id=CVE-2026-33895
Post summary
CVE-2026-33895 affects the node‑forge library (Ed25519 signature verification flaw) before version 1.4.0.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33895 - Forge has signature forgery in Ed25519 due to missing S > L check Intel Report: https://ift.tt/HTq2j43
Post summary
The text announces the discovery of CVE-2026-33895, detailing a signature forgery flaw in Forge's Ed25519 implementation, without presenting patches, exploits, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | digitalbazaar | forge | - | node.js | - |