CVE-2026-118774: Improper Verification of Cryptographic Signature in node-forge X.509 Certificate Validation

Vulnerability ID: CVE-2026-118774
CVSS Score: 3.7
Published: 2026-11-10

CVE-2026-118774 (GHSA-9wg5-mj3p-v49q) is an improper cryptographic signature verification vulnerability (CWE-347) in node-forge versions prior to 1.4.1. When verifying an X.509 subordinate certificate via certificate.verify(child) or verifyCertificateChain(), the library erroneously selects the RSA padding scheme (e.g., PKCS#1 v1.5 vs. RSASSA-PSS) and RSASSA-PSS parameters from the issuer certificate rather than from the child certificate being verified. This enables an attacker to relabel a PKCS#1 v1.5-signed certificate as an RSASSA-PSS certificate without invalidating the signature check, bypassing downstream security policies that mandate RSASSA-PSS.

TL;DR

In node-forge prior to 1.4.1, X.509 certificate verification uses the parent issuer's signature algorithm instead of the child certificate's signature algorithm to determine RSA padding schemes. This allows PKCS#1 v1.5-signed certificates to be relabeled as RSASSA-PSS and pass verification when issued by a PKCS#1 v1.5 CA, bypassing cryptographic scheme enforcement policies.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-118774 (GHSA-9wg5-mj3p-v49q)
Weakness Class: CWE-347: Improper Verification of Cryptographic Signature
Affected Component: node-forge (lib/x509.js: certificate.verify, _verifySignature)
CVSS v3.1 Score: 3.7 Low (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
EPSS Score: 0.103% (0.99th Percentile)
Impact: Cryptographic signature scheme policy bypass and mixed-scheme X.509 chain verification failure
Exploit Status: Proof-of-Concept (Upstream unit test suite)
Patched Version: node-forge 1.4.1

Affected Systems

digitalbazaar forge (node-forge) < 1.4.1
node-forge (forge): < 1.4.1 (Fixed in: 1.4.1)

Code Analysis

Commit: c7f4261

Verify certificate signatures with the child's scheme.

--- a/lib/x509.js +++ b/lib/x509.js @@ -727,12 +727,14 @@ var _createSignatureDigest = function(options) { * * @param options: * certificate the certificate or CSR to verify. + * publicKey the optional public key to verify with. * md the signature digest. * signature the signature * @return a created md instance. throws if unknown oid. */ var _verifySignature = function(options) { var cert = options.certificate; + var publicKey = options.publicKey || cert.publicKey; var scheme; switch(cert.signatureOid) { @@ -779,7 +781,7 @@ var _verifySignature = function(options) { } // verify signature on cert using public key - return cert.publicKey.verify( + return publicKey.verify( options.md.digest().getBytes(), options.signature, scheme ); }; @@ -1184,8 +1186,12 @@ pki.createCertificate = function() { } if(md !== null) { + // the padding scheme comes from the child's signature algorithm rval = _verifySignature({ - certificate: cert, md: md, signature: child.signature + certificate: child, + publicKey: cert.publicKey, + md: md, + signature: child.signature }); }

Exploit Details

GitHub: Official regression test suite in tests/unit/x509.js containing PoC certificates demonstrating RSASSA-PSS relabeling of PKCS#1 v1.5 certificates.

Mitigation Strategies

Upgrade node-forge to version 1.4.1 or later across all direct and transitive dependencies.
Enforce strict consistency checks between the outer Certificate.signatureAlgorithm (cert.signatureOid) and inner TBSCertificate.signature (cert.siginfo.algorithmOid) fields when evaluating X.509 certificates.
Use package manager overrides or resolutions to eliminate vulnerable transitive versions of node-forge in lockfiles.

Remediation Steps:

Run npm ls node-forge to identify all installed instances and versions of node-forge in the project.
Update direct dependencies by running npm install node-forge@^1.4.1 or yarn upgrade node-forge@^1.4.1.
If transitive dependencies require versions prior to 1.4.1, add a "node-forge": "^1.4.1" entry under overrides (npm) or resolutions (Yarn) in package.json.
Re-run unit and integration test suites to verify that certificate chain validation succeeds for both homogeneous and mixed PKCS#1 v1.5 / RSASSA-PSS certificate hierarchies.