node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification

🗓️ 09 Jun 2026 11:19:56Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 14 Views

node-forge Forge allows remote RSASSA version one point five signature forgery via ASN structure data and padding.

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	8 Jul 202608:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution, loss of confidentiality and denial of service	6 May 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses node-forge-1.3.2.tgz, node-forge-1.3.3.tgz which is vulnerable to CVE-2026-33891, CVE-2026-33894, CVE-2026-33895, CVE-2026-33896	5 May 202612:43	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of node-forge-1.3.1.tgz, IBM Sterling Connect:Direct Web Services is affected by Denial of Service (DoS).	2 Jun 202612:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found in Watson Data Intelligence	24 Jun 202618:29	–	ibm
ATTACKERKB	CVE-2026-33894	27 Mar 202620:45	–	attackerkb
Chainguard	CVE-2026-33894 vulnerabilities	31 Mar 202619:17	–	cgr
Circl	CVE-2026-33894	26 Mar 202622:02	–	circl
CNNVD	Digital Bazaar Forge 数据伪造问题漏洞	27 Mar 202600:00	–	cnnvd
CVE	CVE-2026-33894	27 Mar 202620:45	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	automation-gateway-server	2.5.20260422-3.el8ap	automation-gateway-server-2.5.20260422-3.el8ap.noarch.rpm
Red Hat Enterprise Linux	9	noarch	automation-gateway-server	2.5.20260422-3.el9ap	automation-gateway-server-2.5.20260422-3.el9ap.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-33894
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
datatracker	www.datatracker.ietf.org/doc/html/rfc2313
github	www.github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp
mailarchive	www.mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33894
cve	www.cve.org/CVERecord
rfc-editor	www.rfc-editor.org/rfc/rfc8017.html

21 Jul 2026 04:59Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.5

EPSS0.00339

SSVC

node-forge signature forgery rsassa version one point five structure data padding weakness remote attacker