VulnSocial

CVE-2026-85393Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-03); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-03: 1Mentions · 2026-10-02: 1Patch / Workaround · 2026-10-02: 1Technical Details · 2026-09-03: 109-0310-02
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-031
Disclosure1
2026-10-021
Patch1
Full discourse2 posts
  • NeoReplicante@NeoReplicante
    Patch

    CVE-2026-85393 in node-forge has a fix in PR #1152, but no npm release. Stacks using @AnthropicAI's sandbox-runtime are stuck with failing @bunjavascript audits and manual patching. Can we get PR #1152 merged and tagged? @digitalbazaar https://nvd.nist.gov/vuln/detail/cve-2026-85393

    Post summary

    The tweet notes that CVE-2026-85393 in node-forge has a fix available in pull request #1152 but lacks an npm release, urging maintainers to merge and tag the PR so users can apply the patch.

    0000038
    24 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-85393 node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbag… https://www.cve.org/CVERecord?id=CVE-2026-85393

    Post summary

    The post discloses CVE-2026-85393, detailing how node-forge 1.4.0’s RSA PKCS#1 v1.5 signature verification fails to validate element counts in nested DigestAlgorithm sequences, potentially enabling crafted signatures.

    000001.1K
    58.1K followersView on X

Explore more

Back to dashboard