{"id":"EUVD-2026-16834","revision":"e964268010214e79ba878abd457a0f22","records":[{"revision":"e964268010214e79ba878abd457a0f22","observedAt":"2026-10-28T04:02:31.059+00:00","statement":{"source":"euvd","id":"EUVD-2026-16834","aliases":["CVE-2026-33894","GHSA-ppp5-5v6c-4jwp"],"title":"Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers…","description":"Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing “garbage” bytes within the ASN structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN structure, rather than outside of it.  Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":null}],"references":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp","https://datatracker.ietf.org/doc/html/rfc2313#section-8","https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE","https://www.rfc-editor.org/rfc/rfc8017.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16834","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 27, 2026, 8:45:49 PM","dateUpdated":"Sep 10, 2026, 12:04:55 PM"},"relatedAdvisories":[{"id":"RHSA-2026:34342","title":"Red Hat Security Advisory: Cluster Observability Operator 1.5.0","vulnerabilityIds":["CVE-2020-7753","CVE-2021-33623","CVE-2024-4068","CVE-2024-45338","CVE-2024-52011","CVE-2025-22868","CVE-2025-22870","CVE-2025-22872","CVE-2025-47911","CVE-2025-58190","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-4800","CVE-2026-4867","CVE-2026-6321","CVE-2026-6322","CVE-2026-6734","CVE-2026-9277","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-25680","CVE-2026-25681","CVE-2026-29063","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33814","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-33937","CVE-2026-33938","CVE-2026-33939","CVE-2026-33940","CVE-2026-33941","CVE-2026-39821","CVE-2026-42506","CVE-2026-48779"]},{"id":"RHSA-2026:22465","title":"Red Hat Security Advisory: Red Hat Quay 3.17.2","vulnerabilityIds":["CVE-2025-62718","CVE-2026-4427","CVE-2026-27459","CVE-2026-29063","CVE-2026-29074","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-33186","CVE-2026-33747","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:23361","title":"Red Hat Security Advisory: Red Hat Quay 3.9.22","vulnerabilityIds":["CVE-2025-61726","CVE-2025-61728","CVE-2025-62718","CVE-2026-2377","CVE-2026-4427","CVE-2026-4598","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32589","CVE-2026-32590","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:19375","title":"Red Hat Security Advisory: Red Hat Quay 3.16.4","vulnerabilityIds":["CVE-2025-61726","CVE-2025-62718","CVE-2026-2377","CVE-2026-4427","CVE-2026-4598","CVE-2026-4599","CVE-2026-4600","CVE-2026-4601","CVE-2026-4602","CVE-2026-25679","CVE-2026-27137","CVE-2026-27459","CVE-2026-27962","CVE-2026-28802","CVE-2026-29063","CVE-2026-29074","CVE-2026-30922","CVE-2026-32280","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-32597","CVE-2026-33186","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:22629","title":"Red Hat Security Advisory: Red Hat Quay 3.12.18","vulnerabilityIds":["CVE-2025-62718","CVE-2026-2377","CVE-2026-32281","CVE-2026-32282","CVE-2026-32589","CVE-2026-32590","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:24761","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2025-62718","CVE-2026-4926","CVE-2026-7246","CVE-2026-26996","CVE-2026-27904","CVE-2026-30922","CVE-2026-32280","CVE-2026-32282","CVE-2026-32283","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39363","CVE-2026-39892","CVE-2026-40192"]},{"id":"RHSA-2026:9742","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.6 release.","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69534","CVE-2025-69873","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-3118","CVE-2026-4800","CVE-2026-4926","CVE-2026-25679","CVE-2026-26996","CVE-2026-27601","CVE-2026-27904","CVE-2026-29063","CVE-2026-29074","CVE-2026-29186","CVE-2026-32141","CVE-2026-33036","CVE-2026-33228","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39983","CVE-2026-40175"]},{"id":"RHSA-2026:21017","title":"Red Hat Security Advisory: Red Hat Quay 3.14.8","vulnerabilityIds":["CVE-2025-61726","CVE-2025-62718","CVE-2026-2377","CVE-2026-4427","CVE-2026-25679","CVE-2026-27459","CVE-2026-29074","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-33186","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:13826","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.4 release.","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69534","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-3118","CVE-2026-4800","CVE-2026-4926","CVE-2026-27601","CVE-2026-27904","CVE-2026-29063","CVE-2026-29074","CVE-2026-29186","CVE-2026-32141","CVE-2026-32280","CVE-2026-32282","CVE-2026-33228","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39983","CVE-2026-40175","CVE-2026-40895"]},{"id":"WID-SEC-W-2026-1407","title":"IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-26013","CVE-2026-27142","CVE-2026-28277","CVE-2026-28684","CVE-2026-32288","CVE-2026-33151","CVE-2026-33349","CVE-2026-33532","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-33916","CVE-2026-34601","CVE-2026-35469","CVE-2026-39406","CVE-2026-39407","CVE-2026-39408","CVE-2026-39409","CVE-2026-39410","CVE-2026-39983","CVE-2026-40175","CVE-2026-40347","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-4923","CVE-2026-4926"]},{"id":"RHSA-2026:24853","title":"Red Hat Security Advisory: Red Hat Quay 3.15.5","vulnerabilityIds":["CVE-2025-62718","CVE-2026-2377","CVE-2026-4427","CVE-2026-25679","CVE-2026-27459","CVE-2026-27962","CVE-2026-32280","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-33186","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:86618","title":"Red Hat Security Advisory: New container image: rhceph-9.2","vulnerabilityIds":["CVE-2023-46159","CVE-2024-47866","CVE-2024-48916","CVE-2024-55565","CVE-2025-12816","CVE-2025-15599","CVE-2025-26791","CVE-2025-30156","CVE-2025-50181","CVE-2025-50182","CVE-2025-58754","CVE-2025-59343","CVE-2025-62718","CVE-2025-66030","CVE-2025-66035","CVE-2025-66412","CVE-2025-69873","CVE-2026-0540","CVE-2026-21441","CVE-2026-22610","CVE-2026-25639","CVE-2026-26996","CVE-2026-27903","CVE-2026-27904","CVE-2026-27970","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33672","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39865","CVE-2026-40175","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-42033","CVE-2026-42034","CVE-2026-42035","CVE-2026-42036","CVE-2026-42037","CVE-2026-42038","CVE-2026-42039","CVE-2026-42040","CVE-2026-42041","CVE-2026-42042","CVE-2026-42043","CVE-2026-42044","CVE-2026-50152","CVE-2026-58224"]},{"id":"RHSA-2026:22840","title":"Red Hat Security Advisory: Red Hat Quay 3.10.22","vulnerabilityIds":["CVE-2025-62718","CVE-2026-2377","CVE-2026-4598","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32589","CVE-2026-32590","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-16834","identifiers":["EUVD-2026-16834","CVE-2026-33894","GHSA-ppp5-5v6c-4jwp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}