CVE-2026-85393

A flaw was found in node-forge. This vulnerability allows a remote attacker to forge valid RSA PKCS#1 v1.5 signatures for arbitrary messages. The flaw occurs because the software fails to properly validate the element count in nested DigestAlgorithm sequences during signature verification. By embedding specially crafted data, an attacker can bypass signature validation, leading to potential integrity compromise.

Red Hat rates this flaw as having an Important impact because an attacker can remotely forge valid signatures to subvert cryptographic integrity checks without holding the private signing key. In Red Hat environments, node-forge is vendored into various management web consoles and Node.js-based services where signature verification is performed. Successful exploitation requires the verifier to process RSA PKCS#1 v1.5 signatures using small public exponents (such as e=3), allowing Bleichenbacher-style forgery through malformed ASN.1 parsing. Systems utilizing standard exponents like 65537 or alternative signature mechanisms are not susceptible to this attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.