{"action":"Upgrade node-forge to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"node-forge","cve_ids":["CVE-2026-33895"],"ecosystem":"npm","epss":0.00527,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-q67f-28xg-22rw","id":"tcs_01M5KG5CNCVF4JZZ1EF1CN606P","modified_at":"2026-09-10T03:50:40.409799910Z","published_at":"2026-03-26T22:04:41Z","references":["https://osv.dev/vulnerability/GHSA-q67f-28xg-22rw","https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw","https://nvd.nist.gov/vuln/detail/CVE-2022-35961","https://nvd.nist.gov/vuln/detail/CVE-2026-25793","https://nvd.nist.gov/vuln/detail/CVE-2026-33895","https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85","https://datatracker.ietf.org/doc/html/rfc8032#section-8.4","https://github.com/digitalbazaar/forge"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-q67f-28xg-22rw","url":"https://osv.dev/vulnerability/GHSA-q67f-28xg-22rw"}],"summary":"Forge has signature forgery in Ed25519 due to missing S > L check"}