CVE-2026-48815: 
JavaScript vulnerability analysis and mitigation

CVE-2026-48815 is a logic flaw in the sigstore-js npm package where the documented certificateOIDs option passed to sigstore.verify() is silently discarded before verification, meaning required certificate extension OIDs are never enforced. This affects all versions of the sigstore npm package up to and including 4.1.0. The vulnerability was internally fixed via a pull request merged on May 22, 2026, with the advisory published on May 27, 2026, and added to the GitHub Advisory Database on July 1, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is a logic omission (CWE-347: Improper Verification of Cryptographic Signature) in the createVerificationPolicy() function within packages/client/src/config.ts. When constructing the verification policy, the function correctly copies the Subject Alternative Name (SAN) and issuer settings but completely omits the certificateOIDs field, so the downstream verifier never receives those constraints. As a result, any Sigstore bundle that passes the remaining checks (SAN, issuer, transparency log) is accepted regardless of whether the signing certificate carries the required OID extensions. A public PoC demonstrates this: calling createVerificationPolicy() with a certificateOIDs entry produces a policy object where 'certificateOIDs' in policy evaluates to false and the oids field is absent (Github Advisory, Fix PR).

Applications that use certificateOIDs to restrict artifact signing to certificates carrying specific Fulcio or workload-identifying OID extensions receive no such protection — the constraint is silently ignored. An attacker who can obtain a valid Sigstore bundle signed by any certificate that satisfies the remaining (SAN/issuer) checks can have that bundle accepted even if the certificate lacks the required OID extensions. This represents a high-integrity impact: unauthorized certificates that should be rejected are accepted, potentially enabling supply chain attacks where malicious artifacts are treated as legitimately signed (Github Advisory).

1. Identify a target application: Find a Node.js application that uses the sigstore npm package (version ≤ 4.1.0) and calls sigstore.verify() with a certificateOIDs option to enforce certificate extension policy (e.g., restricting signing to a specific CI/CD workflow OID).
2. Obtain or craft a Sigstore bundle: Acquire a valid Sigstore bundle signed by a certificate that satisfies the target application's SAN and issuer constraints but lacks the required OID extensions specified in certificateOIDs.
3. Submit the bundle for verification: Pass the crafted bundle to the vulnerable application's verification endpoint or pipeline. Because createVerificationPolicy() silently drops the certificateOIDs field, the verifier only checks SAN and issuer — not OID extensions.
4. Bypass OID policy enforcement: The bundle is accepted as valid despite the signing certificate missing the required OID extensions, allowing an unauthorized artifact or identity to be treated as trusted (Github Advisory).

Upgrade the sigstore npm package to version 4.1.1 or later, which includes the fix introduced in commit 7845532 that correctly propagates certificateOIDs into the verification policy and enforces OID extension checks via the new verifyOIDs() function (sigstore@4.1.1 Release, Fix Commit). The @sigstore/verify package should also be updated to version 3.1.1 as part of the same fix. There is no known configuration-based workaround for applications relying on certificateOIDs; upgrading is the only remediation.

The vulnerability was reported by three independent researchers (Jvr2022, Str1ckl4nd, and Zyy0530) and fixed by sigstore-js maintainer Brian DeHamer (bdehamer) (Github Advisory). No significant broader media coverage or notable public commentary beyond the advisory and associated GitHub activity has been identified.