DigitalBazaar Forge up to 1.4.0 Signature Verification lib/x509.js _verifySignature certificate validation

Summaryinfo

A vulnerability categorized as problematic has been discovered in DigitalBazaar Forge up to 1.4.0. This affects the function _verifySignature of the file lib/x509.js of the component Signature Verification. Executing a manipulation can lead to certificate validation. This vulnerability is handled as CVE-2026-118774. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in DigitalBazaar Forge up to 1.4.0. This vulnerability affects the function _verifySignature of the file lib/x509.js of the component Signature Verification. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. CVE summarizes:

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and RSASSA-PSS parameters from the issuer certificate rather than the child certificate being verified. A child labeled as RSASSA-PSS could therefore be accepted with a PKCS#1 v1.5 signature when the issuer used PKCS#1 v1.5. The signature still had to be produced with the trusted issuer's private key, so this did not permit certificate identity forgery, but it could bypass policies that require a declared signature scheme. This issue is fixed in version 1.4.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-118774 since 10/28/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading to version 1.4.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• DigitalBazaar

Name

• Forge

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

Website

• Product: https://github.com/digitalbazaar/forge/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion