CVE-2026-33894: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33894 is a Bleichenbacher-style RSA signature forgery vulnerability in the node-forge (digitalbazaar/forge) JavaScript cryptography library, affecting all versions prior to 1.4.0. The flaw allows unauthenticated remote attackers to forge RSASSA PKCS#1 v1.5 signatures when the target RSA key uses a low public exponent (e=3), by stuffing "garbage" bytes within the ASN.1 DigestInfo structure and exploiting the absence of minimum padding enforcement. It was discovered by Austin Chu, Sohee Kim, and Corban Villa as part of a UC Berkeley security research project, disclosed on March 24, 2026, and published to the NVD on March 27, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in two deficiencies within lib/rsa.js of the forge library (CWE-20: Improper Input Validation; CWE-347: Improper Verification of Cryptographic Signature). First, the _parseAllDigestBytes strict DER parsing mode only guarantees all bytes are consumed, not that the DigestInfo structure is the canonical minimal form required by RFC 8017 — allowing attacker-controlled extra ASN.1 fields (e.g., an additional OCTET STRING) inside the parsed container to pass verification. Second, _decodePkcs1_v1_5 acknowledges in comments that padding strings shorter than 8 bytes (PS < 8) should be rejected per RFC 2313, but does not implement this check, giving attackers additional space to craft valid-looking encoded messages. Exploitation leverages cube-root interval construction: since e=3, an attacker computes the cube root of a crafted encoded message (EM) prefix containing the legitimate DigestInfo plus garbage bytes, yielding a forged signature s such that s^3 mod n begins with the expected PKCS#1 structure — a technique that succeeds without knowledge of the private key (GitHub Advisory). This issue is similar to CVE-2022-24771 but differs in that the garbage bytes are placed inside the ASN.1 container rather than outside it (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to forge cryptographically valid RSASSA PKCS#1 v1.5 signatures for any message, without possessing the private key, when the target system uses RSA keys with e=3. The primary impact is a high integrity violation: forged signatures can be used to impersonate legitimate signers, bypass signature-based authentication or authorization controls, and undermine trust in signed data or tokens. There is no direct confidentiality or availability impact, but the ability to forge signatures could enable privilege escalation, session hijacking, or unauthorized access in systems that rely on RSA signature verification for security decisions (GitHub Advisory, Red Hat Bugzilla).

A working proof-of-concept (PoC) script (repro_min.js) was included in the security advisory, demonstrating successful forgery against forge v1.3.3 using a 4096-bit RSA key with e=3; the forged signature passes forge verification but is correctly rejected by Node.js/OpenSSL (GitHub Advisory). No in-the-wild exploitation has been confirmed, and Feedly's analysis classifies the advisory URL as non-exploitable in a weaponized sense. The EPSS score is approximately 0.029–0.038%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Detection is available via Nessus (plugin IDs 304081, 320178) and Qualys (IDs 6635912, 6635780, 6635713, 6635252, 6051414) (GitHub Advisory).

1. Identify target: Locate applications using node-forge versions ≤ 1.3.3 that perform RSASSA PKCS#1 v1.5 signature verification with RSA keys where the public exponent e=3 (e.g., via npm audit, dependency scanning, or inspecting package.json).
2. Obtain the target's public key: Retrieve the RSA public key (PEM format) used by the target application for signature verification — this is typically public information.
3. Compute the forged encoded message (EM): Construct a crafted EM containing the legitimate DigestInfo for the target message (SHA-256 prefix + digest), followed by an extra attacker-controlled ASN.1 OCTET STRING field filled with garbage bytes, padded to the RSA key length k. Use iterative DER length calculation to ensure the total EM size equals k.
4. Apply cube-root forgery: Treat the crafted EM prefix as a numeric interval [low, high). Compute s = ceil_cbrt(low) — the cube root ceiling of the lower bound. Verify that s^3 falls within [low, high) and s < n. This value s is the forged signature, requiring no private key.
5. Submit forged signature: Send the forged signature bytes alongside the target message to the vulnerable forge-based verifier. The key.verify() call with default settings (_parseAllDigestBytes: true) will return true, accepting the forgery.
6. Achieve objective: Use the accepted forged signature to impersonate a legitimate signer, bypass authentication checks, or gain unauthorized access to protected resources (GitHub Advisory).

• Application Logs: Signature verification successes for messages that were not legitimately signed by the expected private key holder; unexpected authentication or authorization grants in application logs coinciding with RSA signature verification events.
• Network: Unusual or automated submission of large binary payloads (matching RSA key size, e.g., 512 bytes for 4096-bit keys) to endpoints that perform signature verification; repeated verification requests from unexpected sources.
• Dependency/File System: Presence of node-forge versions ≤ 1.3.3 in node_modules/ or package-lock.json; absence of upgrade to version 1.4.0 or later in deployed applications.
• Behavioral: RSA signature verification returning true for inputs that are rejected by OpenSSL/Node.js crypto.verify with RSA_PKCS1_PADDING — detectable via differential logging if both verification paths are instrumented.

The primary remediation is to upgrade node-forge to version 1.4.0 or later, which enforces canonical DigestInfo structure (exactly 2 ASN.1 fields) and a minimum of 8 bytes of PKCS#1 v1.5 padding (GitHub Advisory). As an interim workaround where upgrading is not immediately possible, avoid using RSA keys with low public exponents (e=3); use e=65537 (the standard recommended value), as the cube-root forgery technique is only feasible for small exponents. Additionally, consider supplementing signature verification with out-of-band validation or certificate pinning for critical operations. IBM has issued advisories for affected products including IBM Data Product Hub, Watsonx BI Assistant, Maximo Application Suite, App Connect Enterprise, API Connect, Sterling Connect:Direct Web Services, and Watsonx Code Assistant On Prem — users of these products should apply the respective IBM security bulletins (IBM Maximo Advisory, IBM App Connect Advisory). Red Hat has addressed this in Red Hat Ansible Automation Platform 2.5 via RHSA-2026:24761 (Red Hat Bugzilla).

The vulnerability was responsibly disclosed by UC Berkeley researchers (Austin Chu, Sohee Kim, Corban Villa) following a coordinated disclosure policy with a 90-day deadline, and the maintainer (davidlehn) published the advisory and patch on March 24, 2026 (GitHub Advisory). Red Hat rated the issue as high severity and tracked it via Bugzilla, with 44 CC'd users indicating broad internal attention across product teams (Red Hat Bugzilla). IBM issued multiple security bulletins across its product portfolio, reflecting the wide downstream impact of the node-forge dependency. Social media mentions were noted on Mastodon (via @thehackerwire) shortly after public disclosure.