Live › vulnerability › CVE-2026-118774
node-forge, a JavaScript TLS and crypto library, picks RSA padding from the issuer certificate instead of the child certificate during verification. A child certificate labeled RSASSA-PSS can be accepted with a PKCS#1 v1.5 signature, which can bypass policies that require a declared signature scheme.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications that use node-forge to verify X.509 certificate chains, particularly where a policy requires a specific declared signature scheme such as RSASSA-PSS. The sources say the signature still has to come from the trusted issuer's private key, so certificate identity forgery is not possible. Projects that do not use node-forge for certificate verification can skip it.
No product ranges from the sources yet.
npm ls node-forge in each project.package-lock.json or yarn.lock, including transitive dependencies.1.4.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and RSASSA-PSS parameters from the issuer certificate rather than the child certificate being verified. A child labeled as RSASSA-PSS could therefore be accepted with a PKCS#1 v1.5 signature when the issuer used PKCS#1 v1.5. The signature still had to be produced with the trusted issuer's private key, so this did not permit certificate identity forgery, but it could bypass policies that require a declared signature scheme. This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118774")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.