PT-2026-28558 · Unknown · Node-Forge

Corbanvilla + 2 · Publicado 2026-03-26 · Atualizado 2026-05-18 · CVE-2026-33895

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Forge (also called node-forge) versions prior to 1.4.0

Description Forge, a native implementation of Transport Layer Security in JavaScript, contains an issue in Ed25519 signature verification. Specifically, the verification process does not properly check if S is greater than L, potentially leading to signature forgery.

Recommendations Update to version 1.4.0 or later.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CLEANSTART-2026-BE61221

CVE-2026-33895

GHSA-Q67F-28XG-22RW

Produtos afetados

Node-Forge

Referências · 179

• 🔥 https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33895.json · Exploit
• https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85 · Correção
• https://github.com/digitalbazaar/forge · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BE61221.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-q5qw-h33p-qvwr · Nota
• https://osv.dev/vulnerability/CVE-2026-30827 · Nota
• https://osv.dev/vulnerability/CVE-2026-41238 · Nota
• https://osv.dev/vulnerability/ghsa-xhjh-pmcv-23jw · Nota
• https://osv.dev/vulnerability/CVE-2026-42034 · Nota
• https://osv.dev/vulnerability/ghsa-9vqf-7f2p-gf9v · Nota
• https://osv.dev/vulnerability/CVE-2026-44455 · Nota
• https://osv.dev/vulnerability/ghsa-pf86-5x62-jrwf · Nota
• https://osv.dev/vulnerability/CVE-2026-33891 · Nota