OpenPGP.js's message signature verification can be spoofed

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-47934 · CVE overview and exploitation status

EUVD-2025-15798

GHSA-8qff-qr5q-5pr8

cve-program · CVE-2025-47934

• https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-8qff-qr5q-5pr8
• https://github.com/openpgpjs/openpgpjs/commit/43f5f4e2bd67d0514d06acc60b6ee571a049c229
• https://github.com/openpgpjs/openpgpjs/commit/bd54e8535ca29b3bef58a8c02296892e408be356
• https://github.com/openpgpjs/openpgpjs/releases/tag/v5.11.3
• https://github.com/openpgpjs/openpgpjs/releases/tag/v6.1.1

euvd · EUVD-2025-15798

• https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-8qff-qr5q-5pr8
• https://github.com/openpgpjs/openpgpjs/commit/43f5f4e2bd67d0514d06acc60b6ee571a049c229
• https://github.com/openpgpjs/openpgpjs/commit/bd54e8535ca29b3bef58a8c02296892e408be356
• https://github.com/openpgpjs/openpgpjs/releases/tag/v5.11.3
• https://github.com/openpgpjs/openpgpjs/releases/tag/v6.1.1

nvd · CVE-2025-47934

• https://github.com/openpgpjs/openpgpjs/commit/43f5f4e2bd67d0514d06acc60b6ee571a049c229
• https://github.com/openpgpjs/openpgpjs/commit/bd54e8535ca29b3bef58a8c02296892e408be356
• https://github.com/openpgpjs/openpgpjs/releases/tag/v5.11.3
• https://github.com/openpgpjs/openpgpjs/releases/tag/v6.1.1
• https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-8qff-qr5q-5pr8

osv · GHSA-8qff-qr5q-5pr8

• https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-8qff-qr5q-5pr8
• https://nvd.nist.gov/vuln/detail/CVE-2025-47934
• https://github.com/openpgpjs/openpgpjs/commit/43f5f4e2bd67d0514d06acc60b6ee571a049c229
• https://github.com/openpgpjs/openpgpjs/commit/843a69d0adbdec0f87af09f9000a9223e6614e5c
• https://github.com/openpgpjs/openpgpjs/commit/bd54e8535ca29b3bef58a8c02296892e408be356
• https://github.com/openpgpjs/openpgpjs
• https://github.com/openpgpjs/openpgpjs/releases/tag/v5.11.3
• https://github.com/openpgpjs/openpgpjs/releases/tag/v6.1.1

No related changes are available here.