{"id":"EUVD-2026-70670","revision":"cc2a8fa33e5a404badae9bee21b2a524","records":[{"revision":"cc2a8fa33e5a404badae9bee21b2a524","observedAt":"2026-10-28T10:33:58.696+00:00","statement":{"source":"euvd","id":"EUVD-2026-70670","aliases":["CVE-2026-85393","GHSA-86w9-cpqp-85rv"],"title":"node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for …","description":"node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/digitalbazaar/forge/issues/1149","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70670","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 3, 2026, 6:54:25 PM","dateUpdated":"Sep 3, 2026, 7:14:06 PM"},"relatedAdvisories":[{"id":"RHSA-2026:71210","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update","vulnerabilityIds":["CVE-2025-57847","CVE-2025-66418","CVE-2026-15307","CVE-2026-42215","CVE-2026-42284","CVE-2026-44244","CVE-2026-49825","CVE-2026-54284","CVE-2026-59893","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-71491","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-76218","CVE-2026-76219","CVE-2026-76220","CVE-2026-76221","CVE-2026-76222","CVE-2026-78676","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-85393","CVE-2026-87817"]},{"id":"msrc_CVE-2026-85393","title":"node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding","vulnerabilityIds":["CVE-2026-85393"]},{"id":"RHSA-2026:88200","title":"Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images","vulnerabilityIds":["CVE-2026-9496","CVE-2026-19553","CVE-2026-85393","CVE-2026-87776","CVE-2026-89011","CVE-2026-100721"]},{"id":"RHSA-2026:71179","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2025-57847","CVE-2025-66418","CVE-2026-12564","CVE-2026-14257","CVE-2026-15307","CVE-2026-33818","CVE-2026-42215","CVE-2026-42284","CVE-2026-42504","CVE-2026-44244","CVE-2026-49825","CVE-2026-53488","CVE-2026-53492","CVE-2026-54284","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59877","CVE-2026-59893","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-69152","CVE-2026-69153","CVE-2026-69244","CVE-2026-71458","CVE-2026-71459","CVE-2026-71460","CVE-2026-71462","CVE-2026-71463","CVE-2026-71464","CVE-2026-71465","CVE-2026-71491","CVE-2026-73086","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-75884","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76218","CVE-2026-76219","CVE-2026-76220","CVE-2026-76221","CVE-2026-76222","CVE-2026-78676","CVE-2026-78679","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84470","CVE-2026-84474","CVE-2026-84486","CVE-2026-84499","CVE-2026-84502","CVE-2026-84638","CVE-2026-84643","CVE-2026-84644","CVE-2026-84679","CVE-2026-84680","CVE-2026-84683","CVE-2026-84684","CVE-2026-84686","CVE-2026-84689","CVE-2026-84691","CVE-2026-84692","CVE-2026-84703","CVE-2026-84706","CVE-2026-84707","CVE-2026-84708","CVE-2026-84709","CVE-2026-84711","CVE-2026-84712","CVE-2026-84714","CVE-2026-84716","CVE-2026-84717","CVE-2026-84718","CVE-2026-84719","CVE-2026-84720","CVE-2026-84724","CVE-2026-85393","CVE-2026-87817"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-70670","identifiers":["EUVD-2026-70670","CVE-2026-85393","GHSA-86w9-cpqp-85rv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}