Description

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T19:17:31.103Z",
  "pubdate": "2026-09-03T19:17:31.103Z",
  "executiveSummary": "A critical vulnerability exists in node-forge versions up to 1.4.0 regarding RSA PKCS#1 v1.5 signature verification. The flaw involves improper validation of element counts within nested DigestAlgorithm sequences during the cryptographic parsing process.\nThis vulnerability is classified as an incomplete mitigation for CVE-2026-33894. It allows an attacker to manipulate the structure of a signature by embedding arbitrary 'garbage' bytes within the DigestAlgorithm sequence. When utilizing low-exponent RSA keys, this structural manipulation can be leveraged to forge valid digital signatures for arbitrary messages.\nThe impact of this vulnerability is severe, as it undermines the integrity and authenticity guarantees of the node-forge cryptographic library. An attacker could impersonate trusted entities or bypass security controls that rely on signature verification for authentication or code integrity checks.\nExploitation requires the attacker to craft a specific malicious signature that exploits the failure to enforce strict length or count constraints on DER-encoded sequences. The vulnerability is particularly dangerous due to the potential for bypassing security checks in systems utilizing RSA signatures for identity management or data verification.",
  "technicalDetails": "The root cause of this vulnerability lies in the ASN.1 parsing and verification logic within node-forge, specifically concerning the processing of DigestAlgorithm sequences in PKCS#1 v1.5 signatures. The library fails to perform exhaustive validation on the element count within these nested sequences, allowing for the inclusion of extraneous, non-standard data.\nIn a standard PKCS#1 v1.5 signature verification process, the library must parse the DER-encoded DigestInfo structure. This structure includes the algorithm identifier and the hashed value. By injecting garbage bytes into the sequence, the attacker exploits a discrepancy between how the library parses the DER structure and how the underlying mathematical operations are performed during signature verification.\nWhen an RSA public key with a low exponent (such as 3 or 65537) is utilized, the mathematical properties of RSA make it susceptible to signature forgery if the padding or structure is not strictly validated. The vulnerability allows an attacker to construct a signature such that, after parsing the malicious DigestAlgorithm sequence, the resulting verification data matches the expected format, while the actual message content remains arbitrary.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious signature blob containing a malformed DigestAlgorithm sequence where extra bytes are hidden within the sequence length constraints. 2) The attacker provides a target message and the malformed signature to the application using node-forge. 3) The node-forge library parses the structure but fails to detect or reject the illegal extra bytes. 4) The library completes the RSA signature check, returning a 'valid' status for the manipulated signature because the parsed digest data is incorrectly treated as legitimate. 5) The application layer accepts the signature as cryptographically sound.\nThis issue represents an incomplete fix for CVE-2026-33894, indicating that initial efforts to constrain the input failed to account for nested element depth or implicit length encoding. The vulnerability does not require authentication or elevated privileges, provided the application exposes a signature verification endpoint to the attacker. Post-exploitation, the attacker achieves the ability to forge messages, potentially leading to unauthorized data access, code execution, or identity spoofing depending on the application's implementation."
}