CVE-2022-24771
Improper Verification of Cryptographic Signature in node-forge
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Verification of Cryptographic Signature in node-forge
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
CVE-2022-24771- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2022-1403
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
EUVD-2022-1403- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cfm4-qjh2-4765
Improper Verification of Cryptographic Signature in node-forge
Impact
RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used.
Patches
The issue has been addressed in node-forge 1.3.0.
References
For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at example email address
- Record
GHSA-cfm4-qjh2-4765- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
CVE-2022-24771- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
Improper Verification of Cryptographic Signature in node-forge
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
CVE-2022-24771- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24771
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
DEBIAN-CVE-2022-24771- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-cfm4-qjh2-4765
Improper Verification of Cryptographic Signature in node-forge
Impact
RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used.
Patches
The issue has been addressed in node-forge 1.3.0.
References
For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at example email address
- Record
GHSA-cfm4-qjh2-4765- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-24771
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
UBUNTU-CVE-2022-24771- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1774916716 No score
TuxCare security update for node-forge (2 CVEs)
TuxCare rebuilt node-forge to address 2 CVEs. Fixed in 0.10.0-tuxcare.1.
- Record
CLSA-2026-1774916716- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2022-24771 No score
CVE-2022-24771 in node-forge - Patched by Root
Root has patched CVE-2022-24771 in the node-forge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2022-24771- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-forgenpm |
before 1.3.0 | 1.3.0 |
node-forgeTuxCare:npm From an advisory covering 2 CVEs |
0.10.0-tuxcare.0 up to 0.10.0-tuxcare.1, plus listed versions 0.10.0 |
0.10.0-tuxcare.1 |
node-node-forgeDebian:11 |
before 0.10.0~dfsg-3+deb11u1, plus listed versions 0.10.0~dfsg-3 |
0.10.0~dfsg-3+deb11u1 |
node-forgeRoot:npm |
before 0.10.0-aikido.2 | 0.10.0-aikido.20.7.1-aikido.20.7.1-aikido.30.7.1-aikido.40.7.6-aikido.10.10.0-aikido.30.7.1-aikido.50.7.1-aikido.60.7.1-aikido.70.7.6-aikido.20.9.0-aikido.11.0.0-aikido.10.9.0-aikido.20.10.0-aikido.41.3.0-aikido.11.3.0-aikido.21.3.0-aikido.31.3.0-aikido.4 |
@rootio/node-forgeRoot:npm |
before 0.7.1-root.io.2 | 0.7.1-root.io.20.10.0-root.io.20.10.0-root.io.10.7.1-root.io.10.7.1-root.io.30.7.1-root.io.40.7.6-root.io.10.10.0-root.io.30.7.1-root.io.50.7.1-root.io.60.7.1-root.io.70.7.6-root.io.20.9.0-root.io.11.0.0-root.io.10.9.0-root.io.20.10.0-root.io.41.3.0-root.io.21.3.0-root.io.11.3.0-root.io.31.3.0-root.io.4 |
node-node-forgeUbuntu:20.04:LTS |
All versions, plus listed versions 0.8.5~dfsg-20.9.1~dfsg-1 |
None known |
node-node-forgeUbuntu:22.04:LTS |
All versions, plus listed versions 0.10.0~dfsg-31.2.1~dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24771 is a high vulnerability (CVSS 7.5) in Digitalbazaar Forge, published March 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in node-forge 1.3.0.
References
github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765
nvd.nist.gov/vuln/detail/CVE-2022-24771