CVE-2026-85393: Improper Verification of Cryptographic Signature in digitalbazaar forge

The node-forge library through version 1.4.0 fails to correctly validate the number of elements in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. This improper validation permits attackers to insert garbage bytes inside the DigestAlgorithm sequence, which can be exploited to forge valid signatures on arbitrary messages if low-exponent RSA keys are employed. This vulnerability is a partial remediation of CVE-2026-33894 and remains unpatched as no official fix or remediation level has been provided.

Successful exploitation allows attackers to forge cryptographic signatures on arbitrary messages, undermining the integrity and authenticity guarantees of RSA PKCS#1 v1.5 signatures verified by node-forge. This can lead to acceptance of maliciously crafted data as legitimate, potentially compromising applications relying on this library for signature verification. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented at this time. Users should monitor digitalbazaar's advisories for updates and consider mitigating risk by avoiding use of low-exponent RSA keys or employing alternative cryptographic libraries until a fix is available.