PT-2026-28557 · Forge · Forge

Published 2026-03-26 · Updated 2026-05-18 · CVE-2026-33894

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.0

Description Forge, a native implementation of Transport Layer Security in JavaScript, has a flaw in its RSASSA PKCS#1 v1.5 signature verification process. This issue allows attackers to forge signatures for keys with a low public exponent (e=3) by inserting “garbage” bytes within the ASN.1 structure. This enables a Bleichenbacher-style forgery. The issue is similar to a previously known issue but differs in how the extra bytes are added. Additionally, Forge does not enforce the minimum 8-byte padding requirement as defined by the specification, providing attackers with more space to construct forgeries. A proof-of-concept demonstrates that a forged signature can be created that is accepted by Forge but rejected by Node/OpenSSL. The vulnerability affects deployments using the default settings for key verification, specifically when parseAllDigestBytes is set to true.

Recommendations Update to Forge version 1.4.0 or later to address this vulnerability.

Exploit

Fix

RCE

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-20

CWE-347

Related Identifiers

CLEANSTART-2026-BE61221

CVE-2026-33894

GHSA-PPP5-5V6C-4JWP

Affected Products

Forge

References · 179

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33894.json · Exploit
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6322 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42338 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69873 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-BE61221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35213 · Security Note