GHSA-q67f-28xg-22rw
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 26, 2026
CISA due date
—
The record
Forge has signature forgery in Ed25519 due to missing S > L check
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | node-forge | 0 | 1.4.0 |
| Chainguard | kibana-7 | 0 | 7.17.29-r8 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r15 |
| Chainguard | kibana-8.17-bitnami | 0 | 8.17.10-r15 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r15 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r11 |
| Chainguard | kibana-8.18-bitnami | 0 | 8.18.8-r11 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r11 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r16 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r16 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r16 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.16.0-r11 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.5-r6 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r5 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r11 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.16.0-r11 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.5-r6 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r11 |
Related vulnerabilities
- CVE-2026-33895 Forge (also called `node-forge`) is a native implementation of Transport Layer Security… Same vulnerability
- CVE-2026-33896 Forge (also called `node-forge`) is a native implementation of Transport Layer Security… Also affects node-forge
- CVE-2026-33894 Forge (also called `node-forge`) is a native implementation of Transport Layer Security… Also affects node-forge
- CVE-2026-33891 Forge (also called `node-forge`) is a native implementation of Transport Layer Security… Also affects node-forge
- GHSA-2328-f5f3-gj25 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280… Also affects node-forge
- GHSA-ppp5-5v6c-4jwp Forge has signature forgery in RSA-PKCS due to ASN.1 extra field Also affects node-forge
- GHSA-5m6q-g25r-mvwx Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input Also affects node-forge
- GHSA-554w-wpv2-vw27 node-forge has ASN.1 Unbounded Recursion Also affects node-forge