CVE-2026-118774: Improper Verification of Cryptographic Signature in node-forge X.509 Certificate Validation

Vulnerability ID: CVE-2026-118774
CVSS Score: 3.7
Published: 2026-11-10

CVE-2026-118774 (GHSA-9wg5-mj3p-v49q) is an improper cryptographic signature verification vulnerability (CWE-347) in node-forge versions prior to 1.4.1. When verifying an X.509 subordinate certificate via certificate.verify(child) or verifyCertificateChain(), the library erroneously selects the RSA padding scheme (e.g., PKCS#1 v1.5 vs. RSASSA-PSS) and RSASSA-PSS parameters from the issuer certificate rather than from the child certificate being verified. This enables an attacker to relabel a PKCS#1 v1.5-signed certificate as an RSASSA-PSS certificate without invalidating the signature check, bypassing downstream security policies that mandate RSASSA-PSS.

TL;DR

In node-forge prior to 1.4.1, X.509 certificate verification uses the parent issuer's signature algorithm instead of the child certificate's signature algorithm to determine RSA padding schemes. This allows PKCS#1 v1.5-signed certificates to be relabeled as RSASSA-PSS and pass verification when issued by a PKCS#1 v1.5 CA, bypassing cryptographic scheme enforcement policies.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-118774 (GHSA-9wg5-mj3p-v49q)
• Weakness Class: CWE-347: Improper Verification of Cryptographic Signature
• Affected Component: node-forge (lib/x509.js: certificate.verify, _verifySignature)
• CVSS v3.1 Score: 3.7 Low (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
• EPSS Score: 0.103% (0.99th Percentile)
• Impact: Cryptographic signature scheme policy bypass and mixed-scheme X.509 chain verification failure
• Exploit Status: Proof-of-Concept (Upstream unit test suite)
• Patched Version: node-forge 1.4.1

Affected Systems

• digitalbazaar forge (node-forge) < 1.4.1
• node-forge (forge): < 1.4.1 (Fixed in: 1.4.1)

Code Analysis

Commit: c7f4261

Verify certificate signatures with the child's scheme.

--- a/lib/x509.js
+++ b/lib/x509.js
@@ -727,12 +727,14 @@ var _createSignatureDigest = function(options) {
  *
  * @param options:
  *   certificate the certificate or CSR to verify.
+ *   publicKey the optional public key to verify with.
  *   md the signature digest.
  *   signature the signature
  * @return a created md instance. throws if unknown oid.
  */
 var _verifySignature = function(options) {
   var cert = options.certificate;
+  var publicKey = options.publicKey || cert.publicKey;
   var scheme;

   switch(cert.signatureOid) {
@@ -779,7 +781,7 @@ var _verifySignature = function(options) {
   }

   // verify signature on cert using public key
-  return cert.publicKey.verify(
+  return publicKey.verify(
     options.md.digest().getBytes(), options.signature, scheme
   );
 };
@@ -1184,8 +1186,12 @@ pki.createCertificate = function() {
     }

     if(md !== null) {
+      // the padding scheme comes from the child's signature algorithm
       rval = _verifySignature({
-        certificate: cert, md: md, signature: child.signature
+        certificate: child,
+        publicKey: cert.publicKey,
+        md: md,
+        signature: child.signature
       });
     }

Exploit Details

• GitHub: Official regression test suite in tests/unit/x509.js containing PoC certificates demonstrating RSASSA-PSS relabeling of PKCS#1 v1.5 certificates.

Mitigation Strategies

• Upgrade node-forge to version 1.4.1 or later across all direct and transitive dependencies.
• Enforce strict consistency checks between the outer Certificate.signatureAlgorithm (cert.signatureOid) and inner TBSCertificate.signature (cert.siginfo.algorithmOid) fields when evaluating X.509 certificates.
• Use package manager overrides or resolutions to eliminate vulnerable transitive versions of node-forge in lockfiles.

Remediation Steps:

1. Run npm ls node-forge to identify all installed instances and versions of node-forge in the project.
2. Update direct dependencies by running npm install node-forge@^1.4.1 or yarn upgrade node-forge@^1.4.1.
3. If transitive dependencies require versions prior to 1.4.1, add a "node-forge": "^1.4.1" entry under overrides (npm) or resolutions (Yarn) in package.json.
4. Re-run unit and integration test suites to verify that certificate chain validation succeeds for both homogeneous and mixed PKCS#1 v1.5 / RSASSA-PSS certificate hierarchies.

References

• GitHub Security Advisory GHSA-9wg5-mj3p-v49q
• GitHub Fix Commit c7f42614d5166a77ddf11ce174b2601b14f6956b
• GitHub Release v1.4.1
• NVD Vulnerability Detail: CVE-2026-118774
• CVE.org Official Record: CVE-2026-118774
• cvelistV5 Repository Record for CVE-2026-118774

Read the full report for CVE-2026-118774 on our website for more details including interactive diagrams and full exploit analysis.