CVE-2026-85393

node-forge through 1.4.0 fails to validate the element count in nested DigestAlgorithm ASN.1 sequences while verifying RSA PKCS#1 v1.5 signatures (CWE-347), leaving the parser open to malformed inputs. By embedding garbage bytes inside the DigestAlgorithm sequence of a crafted signature, an attacker can make a forged signature validate for an arbitrary message against RSA keys that use a low public exponent. Successful forgery lets an attacker impersonate a legitimate signer and defeat signature-based authentication or integrity checks without knowing the private key. Any application using node-forge version 1.4.0 or earlier to verify RSA PKCS#1 v1.5 signatures on untrusted data is affected, and this is an incomplete fix for the earlier flaw CVE-2026-33894, so previously patched deployments remain exposed. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS gives a 0.2% probability of exploitation within 30 days (10th percentile).

What to do: Upgrade node-forge to the first release after 1.4.0 that validates DigestAlgorithm sequence element counts (no fixed version is stated in the available data, so monitor the node-forge npm/GitHub advisory) and confirm the patch covers the nested-sequence case left open by CVE-2026-33894. Audit your dependency tree (e.g., 'npm ls node-forge' or lockfile scanning) to find transitive uses, and as an interim mitigation verify untrusted PKCS#1 v1.5 signatures with a different patched library and prefer RSA keys with a standard exponent (e.g., 65537) over low-exponent keys.