CVE-2026-33895: Node-Forge Auth Bypass Vulnerability

CVE-2026-33895 Overview

CVE-2026-33895 is a signature malleability vulnerability affecting Forge (also known as node-forge), a native JavaScript implementation of Transport Layer Security. The vulnerability exists in the Ed25519 signature verification implementation, which accepts forged non-canonical signatures where the scalar S is not properly reduced modulo the group order (S >= L). This allows attackers to create alternate valid signatures for any legitimately signed message, potentially bypassing authentication and authorization mechanisms.

Critical Impact

Authentication and authorization bypass through signature malleability attacks. Applications relying on signature uniqueness for deduplication, replay tracking, or signed-object canonicalization checks may be compromised.

Affected Products

• Forge (node-forge) versions prior to 1.4.0
• Applications using node-forge for Ed25519 signature verification
• Systems implementing signature-based authentication or replay protection with node-forge

Discovery Timeline

• 2026-03-27 - CVE-2026-33895 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33895

Vulnerability Analysis

The vulnerability stems from an improper verification of cryptographic signatures (CWE-347) in the Ed25519 implementation. According to IETF RFC 8032 Section 8.4, compliant implementations must reject signatures where the scalar S is greater than or equal to the group order L. However, node-forge prior to version 1.4.0 fails to enforce this constraint, accepting both canonical signatures and their S + L variants as valid.

This discrepancy creates a signature malleability issue where an attacker can take any valid signature and compute an alternate signature that also passes verification. While both signatures correspond to the same message and public key, they have different byte representations. This class of vulnerability has been previously exploited in real-world attacks as documented in CVE-2026-25793 and CVE-2022-35961.

Root Cause

The root cause is the missing validation check in the Ed25519 signature verification routine. The implementation does not verify that the scalar component S of the signature is in the valid range 0 <= S < L, where L is the order of the Ed25519 base point. This allows signatures with S >= L to pass verification when they should be rejected per the Ed25519 specification.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker who obtains a legitimate signed message can compute an alternate signature by adding L to the scalar component S. This malleated signature will verify successfully against the same message and public key.

The attack enables several exploitation scenarios:

The signature malleability can be exploited to bypass replay protection mechanisms. If an application tracks previously seen signatures to prevent replay attacks, an attacker can submit the S + L variant of a signature to bypass this check while the verification still succeeds.

For authentication systems that use signature uniqueness as part of identity verification or session binding, an attacker could potentially impersonate a legitimate user or bypass authorization checks by presenting a malleated version of a captured signature.

Applications performing deduplication based on signature bytes or implementing signed-object canonicalization checks are also vulnerable, as the malleated signature represents the same logical authorization but with different bytes.

For technical details on the fix, see the GitHub Forge Commit Update.

Detection Methods for CVE-2026-33895

Indicators of Compromise

• Multiple valid signatures observed for identical signed content from the same public key
• Signature values where the S component exceeds the Ed25519 group order L (2^252 + 27742317777372353535851937790883648493)
• Authentication or authorization events with signatures that differ only in the S component
• Anomalous replay protection bypass events in application logs

Detection Strategies

• Implement monitoring for duplicate signed payloads with different signature bytes in authentication systems
• Add validation rules to detect signatures with S values exceeding the Ed25519 group order threshold
• Conduct code audits to identify usage of node-forge Ed25519 verification in security-critical paths
• Compare signature verification results between node-forge and OpenSSL-backed implementations to identify discrepancies

Monitoring Recommendations

• Monitor authentication logs for repeated authentication attempts using the same payload but different signatures
• Implement alerting for signature verification events that would fail with stricter implementations
• Track dependency usage across applications to identify systems using vulnerable node-forge versions
• Enable detailed logging on systems performing Ed25519 signature verification for forensic analysis

How to Mitigate CVE-2026-33895

Immediate Actions Required

• Upgrade node-forge to version 1.4.0 or later immediately
• Audit applications using node-forge for Ed25519 signature verification in security-critical contexts
• Review authentication and replay protection mechanisms for potential bypass through signature malleability
• Consider implementing additional signature canonicalization checks at the application layer as defense in depth

Patch Information

The vulnerability is resolved in node-forge version 1.4.0, which adds proper validation to ensure the scalar S component is reduced modulo the group order before accepting signatures. The fix implements the check specified in IETF RFC 8032 Section 8.4.

For detailed patch information, refer to the GitHub Security Advisory GHSA-q67f-28xg-22rw.

Workarounds

• Implement additional server-side validation to reject signatures with S values >= L before passing to node-forge
• Use alternative Ed25519 implementations that properly enforce signature canonicalization (such as Node.js native crypto.verify)
• Add application-layer signature normalization that validates and rejects non-canonical signatures
• Implement hash-based tracking of signed payloads rather than signature bytes for replay protection

# Update node-forge to patched version
npm update node-forge@1.4.0

# Verify installed version
npm list node-forge

# Audit for vulnerable versions in dependency tree
npm audit