PT-2026-28558 · Unknown · Node-Forge

Corbanvilla + 2 · Published 2026-03-26 · Updated 2026-05-18 · CVE-2026-33895

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Forge (also called node-forge) versions prior to 1.4.0

Description Forge, a native implementation of Transport Layer Security in JavaScript, contains an issue in Ed25519 signature verification. Specifically, the verification process does not properly check if S is greater than L, potentially leading to signature forgery.

Recommendations Update to version 1.4.0 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CLEANSTART-2026-BE61221

CVE-2026-33895

GHSA-Q67F-28XG-22RW

Affected Products

Node-Forge

References · 179

• 🔥 https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33895.json · Exploit
• https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6322 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42338 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69873 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-BE61221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35213 · Security Note