{"id":"GHSA-6qrw-m8cv-hcxf","summary":"Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding","details":"### Summary\nRSASSA-PKCS1-v1_5 signature verification (`publicKey.verify()` with the default scheme, also used by X.509 certificate and PKCS#7 verification) accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-minimal lengths. These leave attacker-controlled bytes inside an accepted DigestInfo, which allows signatures to be forged without the private key for RSA keys with a low public exponent (e=3). Fixed in node-forge 1.4.1.\n\n### Details\nIn `lib/rsa.js`, `key.verify()` with the default `RSASSA-PKCS1-V1_5` scheme removes the padding, parses the recovered DigestInfo with the lenient BER parser `asn1.fromDer()` and checks its structure with `asn1.validate()` against `digestInfoValidator`. Neither requires a canonical DER encoding, so verification accepted, among others:\n- NULL parameters with content bytes (e.g. `05 40 \u003c64 bytes\u003e`)\n- non-NULL or constructed values in the parameters position\n- non-minimal (long form) and indefinite lengths\n- non-canonical OID encodings (padded subidentifiers, trailing bytes)\n\nThese leave attacker-controlled bytes inside an accepted DigestInfo. For RSA keys with a low public exponent (e=3) this allows signatures to be forged without the private key (BERserk / Bleichenbacher-style forgery, see CVE-2014-1568).\n\nRFC 8017 section 8.2.2 verifies a signature by encoding the expected EMSA-PKCS1-v1_5 message and comparing it with the recovered one; section 9.2 defines the DigestInfo encoding.\n\nThe fix adds `_encodeDigestInfo()`, which DER-encodes the expected DigestInfo from the digest algorithm OID and the digest (with and without NULL parameters). Verification now requires the recovered DigestInfo to match one of these encodings byte for byte. The same change fixes GHSA-2g46-22mc-6gwp (CVE-2026-85393).\n\n#### Patches\nFixed in node-forge 1.4.1. Verification now re-encodes the expected DigestInfo and requires a byte-for-byte match (RFC 8017 section 8.2.2).\n\n#### Workarounds\nDo not use RSA keys with a low public exponent (e=3) for signature verification.\n\n#### References\n- https://www.rfc-editor.org/rfc/rfc8017#section-8.2.2\n- https://www.rfc-editor.org/rfc/rfc8017#section-9.2\n- CVE-2026-85393 / GHSA-2g46-22mc-6gwp (related, same fix)\n- CVE-2026-33894 / https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp\n- https://www.cve.org/CVERecord?id=CVE-2014-1568 (BERserk)\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5, High)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N (8.2)\nBoth versions rate this High. The severity rating follows CVSS 3.1.\n\n#### Credits\nIndependently reported by Oren Yomtov (@orenyomtov, Fireblocks), Bronson Yen (Calif.io, in collaboration with Claude and Anthropic Research), Kamil Hałajda, @pzartech, @antonlissone and @Brechard.\n\n### Proof of concept\nDigestInfo encodings accepted before 1.4.1 (SHA-256; OID = 06 09 60 86 48 01 65 03 04 02 01, H = the 32-byte digest):\n\n    NULL parameters with content:  30 33 30 0F \u003cOID\u003e 05 02 BE EF 04 20 \u003cH\u003e\n    non-minimal DigestInfo length: 30 81 31 30 0D \u003cOID\u003e 05 00 04 20 \u003cH\u003e\n    (canonical form:               30 31 30 0D \u003cOID\u003e 05 00 04 20 \u003cH\u003e)\n\nLong-form lengths are accepted the same way for the DigestAlgorithm, OID, NULL and digest fields. A signature whose EMSA-PKCS1-v1_5 block (00 01 FF..FF 00 || DigestInfo) contains such an encoding verified as valid: `publicKey.verify(digest, signature)` returned true. Content bytes in the NULL parameters (reports used e.g. `05 40 \u003c64 bytes\u003e`) and similar slack give an attacker room to construct a forged signature for an e=3 key. With 1.4.1, verification throws \"ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.\"\n\nRegression tests: tests/unit/rsa.js, \"canonical DigestInfo checks\". They use an e=1 key, so the signature equals the encoded block, with one test per non-canonical shape (also indefinite length, constructed and non-NULL parameters, padded OID subidentifiers) and two tests that the canonical encodings with and without NULL parameters still verify. Included in the 1.4.1 release.\n\n### Impact\nApplications that verify RSASSA-PKCS1-v1_5 signatures with node-forge: `publicKey.verify()` with the default scheme, and X.509 certificate and PKCS#7 signature verification, which use it. If the verifying RSA public key has a low public exponent (e=3), an attacker can forge a signature that verifies as valid, without the private key. Only keys with a small public exponent such as e=3 are practically affected.","aliases":["CVE-2026-119192"],"modified":"2026-11-10T16:15:04.157919204Z","published":"2026-11-10T15:57:34Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-347"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-11-10T15:57:34Z"},"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-2g46-22mc-6gwp"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6qrw-m8cv-hcxf"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/commit/2bce9d477a2ff436e86ff9694ae999f1552aa2bb"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"}],"affected":[{"package":{"name":"node-forge","ecosystem":"npm","purl":"pkg:npm/node-forge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.4.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6qrw-m8cv-hcxf/GHSA-6qrw-m8cv-hcxf.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}