{"id":"CVE-2026-48758","summary":"sigstore-js: DSSE payloadType type-binding failure","details":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.","aliases":["GHSA-jfc7-64v2-mr8c"],"modified":"2026-07-17T03:41:52.978727559Z","published":"2026-07-14T20:36:28.641Z","related":["CGA-9w9g-h55c-c35v"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-347"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48758.json"},"references":[{"type":"WEB","url":"https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48758.json"},{"type":"ADVISORY","url":"https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48758"},{"type":"FIX","url":"https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7"},{"type":"FIX","url":"https://github.com/sigstore/sigstore-js/pull/1657"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sigstore/sigstore-js","events":[{"introduced":"0"},{"fixed":"b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.2.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["@sigstore/tuf@4.0.2","@sigstore/sign@4.1.1","@sigstore/oci@0.6.1","@sigstore/mock@0.12.0","@sigstore/core@3.2.0","@sigstore/cli@0.9.1","sigstore@4.1.0","@sigstore/sign@4.0.1","sigstore@4.0.0","@sigstore/verify@3.0.0","@sigstore/tuf@4.0.0","@sigstore/sign@4.0.0","@sigstore/rekor-types@4.0.0","@sigstore/oci@0.6.0","@sigstore/mock@0.11.0","@sigstore/core@3.0.0","@sigstore/cli@0.9.0","@sigstore/bundle@4.0.0","@sigstore/verify@2.1.1","@sigstore/tuf@3.1.1","@sigstore/oci@0.5.0","@sigstore/cli@0.8.2","sigstore@3.1.0","@sigstore/verify@2.1.0","@sigstore/tuf@3.1.0","@sigstore/sign@3.1.0","@sigstore/mock@0.10.0","@sigstore/bundle@3.1.0","@sigstore/mock@0.9.0","sigstore@3.0.0","@sigstore/verify@2.0.0","@sigstore/tuf@3.0.0","@sigstore/sign@3.0.0","@sigstore/rekor-types@3.0.0","@sigstore/oci@0.4.0","@sigstore/mock@0.8.0","@sigstore/core@2.0.0","@sigstore/cli@0.8.1","@sigstore/bundle@3.0.0","@sigstore/oci@0.3.7","@sigstore/oci@0.3.6","@sigstore/oci@0.3.5","@sigstore/mock@0.7.5","@sigstore/oci@0.3.4","sigstore@2.3.1","@sigstore/verify@1.2.1","@sigstore/tuf@2.3.4","@sigstore/sign@2.3.2","@sigstore/oci@0.3.3","@sigstore/mock@0.7.4","@sigstore/bundle@2.3.2","@sigstore/oci@0.3.2","@sigstore/tuf@2.3.3","@sigstore/sign@2.3.1","@sigstore/oci@0.3.1","@sigstore/mock@0.7.3","@sigstore/cli@0.8.0","sigstore@2.3.0","@sigstore/verify@1.2.0","@sigstore/bundle@2.3.1","@sigstore/sign@2.3.0","@sigstore/oci@0.3.0","@sigstore/mock@0.7.2","@sigstore/cli@0.7.1","@sigstore/bundle@2.3.0","@sigstore/verify@1.1.1","@sigstore/tuf@2.3.2","@sigstore/mock@0.7.1","@sigstore/core@1.1.0","@sigstore/oci@0.2.0","@sigstore/mock@0.7.0","@sigstore/cli@0.7.0","sigstore@2.2.2","@sigstore/verify@1.1.0","@sigstore/tuf@2.3.1","@sigstore/sign@2.2.3","@sigstore/mock@0.6.5","@sigstore/bundle@2.2.0","@sigstore/oci@0.1.0","sigstore@2.2.1","@sigstore/verify@1.0.0","@sigstore/sign@2.2.2","@sigstore/mock@0.6.4","@sigstore/core@1.0.0","sigstore@2.2.0","@sigstore/verify@0.1.0","@sigstore/tuf@2.3.0","@sigstore/sign@2.2.1","@sigstore/mock@0.6.3","@sigstore/core@0.2.0","@sigstore/cli@0.6.0","@sigstore/bundle@2.1.1","@sigstore/mock@0.6.2","@sigstore/core@0.1.0","@sigstore/sign@2.2.0","@sigstore/mock@0.6.1","@sigstore/cli@0.5.0","@sigstore/mock@0.6.0","@sigstore/cli@0.4.0","@sigstore/tuf@2.2.0","@sigstore/mock@0.5.0","@sigstore/cli@0.3.0","sigstore@2.1.0","@sigstore/tuf@2.1.0","@sigstore/sign@2.1.0","@sigstore/mock@0.4.0","@sigstore/cli@0.2.1","@sigstore/bundle@2.1.0","sigstore@2.0.0","@sigstore/tuf@2.0.0","@sigstore/sign@2.0.0","@sigstore/rekor-types@2.0.0","@sigstore/mock@0.3.0","@sigstore/cli@0.2.0","@sigstore/bundle@2.0.0","sigstore@1.9.0","@sigstore/sign@1.0.0","@sigstore/mock@0.2.0","@sigstore/cli@0.1.2","@sigstore/bundle@1.1.0","sigstore@1.8.0","@sigstore/tuf@1.0.3","@sigstore/mock@0.1.1","@sigstore/cli@0.1.1","@sigstore/bundle@1.0.0","@sigstore/tuf@1.0.2","sigstore@1.7.0","@sigstore/tuf@1.0.1","@sigstore/mock@0.1.0","sigstore@1.6.0","@sigstore/tuf@1.0.0","@sigstore/rekor-types@1.0.0","@sigstore/cli@0.1.0","@sigstore/rekor-types@0.0.3","@sigstore/cli@0.0.5","sigstore@1.5.2","@sigstore/cli@0.0.4","@sigstore/cli@0.0.3","sigstore@1.5.1","@sigstore/rekor-types@0.0.2","@sigstore/cli@0.0.2","v1.5.0","v1.4.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.1","v1.1.0","v1.0.0","v1.0.0-beta.1","v0.4.0","v0.3.0","v0.2.0","v0.1.1","v0.1.0","v0.0.1-alpha.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48758.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}]}