CVE-2026-33894: node-forge Auth Bypass Vulnerability

CVE-2026-33894 Overview

CVE-2026-33894 is a cryptographic signature verification vulnerability affecting Forge (also known as node-forge), a native JavaScript implementation of Transport Layer Security (TLS). Prior to version 1.4.0, the library's RSASSA PKCS#1 v1.5 signature verification implementation incorrectly accepts forged signatures when used with low public exponent keys (e=3). This flaw enables attackers to construct fraudulent signatures that pass verification, undermining the integrity guarantees that digital signatures are meant to provide.

The vulnerability is a variant of the well-known Bleichenbacher signature forgery attack. Attackers can exploit this by stuffing "garbage" bytes within the ASN.1 structure to create signatures that improperly pass verification. This issue is similar to CVE-2022-24771 but differs in that the injected bytes are placed within an additional field inside the ASN structure rather than outside of it. Additionally, node-forge fails to validate that signatures include a minimum of 8 bytes of padding as required by the PKCS#1 specification, providing attackers with additional space to craft successful forgeries.

Critical Impact

Attackers can forge digital signatures for systems using node-forge with low exponent RSA keys, potentially bypassing authentication, software update verification, or document signing integrity checks.

Affected Products

• node-forge versions prior to 1.4.0
• Applications using node-forge for RSASSA PKCS#1 v1.5 signature verification
• Systems relying on RSA keys with low public exponents (e=3)

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33894 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33894

Vulnerability Analysis

This vulnerability stems from improper validation of RSASSA PKCS#1 v1.5 signatures in the node-forge library. The PKCS#1 v1.5 signature scheme requires careful parsing and validation of the signature's ASN.1-encoded DigestInfo structure. When RSA keys with a low public exponent (e=3) are used, the mathematical properties of RSA make it possible for attackers to construct values that, when cubed, produce bit patterns that satisfy a weak signature verification implementation.

The attack leverages two weaknesses in the node-forge implementation: First, the library accepts additional bytes within the ASN.1 structure that should be rejected. Second, it fails to enforce the PKCS#1 requirement for a minimum of 8 bytes of 0xFF padding between the block type identifier and the digest structure. These weaknesses together provide attackers sufficient flexibility to forge signatures without knowledge of the private key.

Root Cause

The root cause is improper input validation (CWE-20) in the signature verification logic. Specifically, the implementation does not strictly validate the ASN.1 DigestInfo structure and fails to enforce mandatory padding requirements defined in IETF RFC 8017. The specification requires that the encoded message block contain at least 8 octets of 0xFF padding, but node-forge did not validate this constraint, allowing attackers to use the freed space for constructing forged signatures.

Attack Vector

The attack can be executed over the network without authentication or user interaction. An attacker targeting a system that uses node-forge for signature verification with low-exponent RSA keys can forge signatures by carefully constructing malformed ASN.1 structures. The forged signature would pass verification despite not being generated with the legitimate private key.

The attack methodology, known as Bleichenbacher's signature forgery, involves mathematically computing a value that when raised to the low public exponent produces a bit pattern with:

• Correct PKCS#1 v1.5 block format markers in expected positions
• Valid hash algorithm identifier and digest value
• Garbage bytes occupying space where the implementation fails to perform strict validation

For detailed technical information about the vulnerability mechanics, refer to the GitHub Security Advisory and the IETF OpenPGP discussion on signature verification requirements.

Detection Methods for CVE-2026-33894

Indicators of Compromise

• Unexpected successful authentication events where signature verification is involved
• Application logs showing signature verification for unusually structured or malformed signatures
• Authentication tokens or signed documents with anomalous ASN.1 structures
• Network traffic containing RSA signatures with abnormal padding patterns

Detection Strategies

• Audit application dependencies to identify node-forge versions below 1.4.0
• Implement logging of signature verification operations to capture suspicious patterns
• Review RSA key configurations to identify low public exponent keys (e=3)
• Deploy static analysis tools to scan JavaScript dependencies for vulnerable versions

Monitoring Recommendations

• Monitor authentication systems for unusual signature verification patterns
• Implement alerting on signature verification failures followed by successes with similar payloads
• Track updates to node-forge and other cryptographic libraries in your dependency tree
• Review audit logs for applications that rely on digital signature verification

How to Mitigate CVE-2026-33894

Immediate Actions Required

• Upgrade node-forge to version 1.4.0 or later immediately
• Audit RSA key configurations and replace keys with low public exponents (e=3) with standard exponents (e=65537)
• Review systems that rely on signature verification for authentication or integrity
• Conduct security assessment of applications using affected node-forge versions

Patch Information

The vulnerability is patched in node-forge version 1.4.0. Organizations should update their dependencies to this version or later. The patch implements strict validation of the ASN.1 DigestInfo structure and enforces the mandatory 8-byte padding requirement specified in PKCS#1. For detailed patch information, review the GitHub Security Advisory.

Workarounds

• Use RSA keys with standard public exponents (e=65537) instead of low exponents (e=3)
• Consider implementing additional signature verification using alternative cryptographic libraries
• If upgrading is not immediately possible, implement application-level validation of signature structures
• Disable or restrict functionality that relies on RSASSA PKCS#1 v1.5 signatures until patching is complete

# Update node-forge to patched version
npm update node-forge@1.4.0

# Verify installed version
npm list node-forge

# Audit for vulnerable dependencies
npm audit