{"action":"Upgrade browserify-sign to 4.2.2 or later.","affected":[{"fixed":"4.2.2","introduced":"2.6.0"}],"component":"browserify-sign","cve_ids":["CVE-2023-46234"],"ecosystem":"npm","epss":0.00563,"exploited":false,"fixed_versions":["4.2.2"],"ghsa_id":"GHSA-x9w5-v3q2-3rhw","id":"tcs_01M5KGHJGH830AZM3BZT3846MY","modified_at":"2026-09-10T03:50:08.674168828Z","published_at":"2023-10-26T20:53:21Z","references":["https://osv.dev/vulnerability/GHSA-x9w5-v3q2-3rhw","https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw","https://nvd.nist.gov/vuln/detail/CVE-2023-46234","https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30","https://github.com/browserify/browserify-sign","https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ","https://www.debian.org/security/2023/dsa-5539"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-x9w5-v3q2-3rhw","url":"https://osv.dev/vulnerability/GHSA-x9w5-v3q2-3rhw"}],"summary":"browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack"}