{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.4.0"}],"component":"node-forge","cve_ids":["CVE-2026-33894","CVE-2026-85393"],"ecosystem":"npm","epss":0.00481,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-86w9-cpqp-85rv","id":"tcs_01M5KFC176J3YW2JJSK71NBDZW","modified_at":"2026-10-01T21:40:55.016251436Z","published_at":"2026-09-03T21:31:15Z","references":["https://osv.dev/vulnerability/GHSA-86w9-cpqp-85rv","https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/digitalbazaar/forge/pull/1152","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-86w9-cpqp-85rv","url":"https://osv.dev/vulnerability/GHSA-86w9-cpqp-85rv"}],"summary":"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements"}