CVE-2022-24772
Improper Verification of Cryptographic Signature in `node-forge`
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Verification of Cryptographic Signature in `node-forge`
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
CVE-2022-24772- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2022-1576
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
EUVD-2022-1576- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in node-forge
Impact
RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used.
Patches
The issue has been addressed in node-forge 1.3.0.
References
For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at example email address
- Record
GHSA-x4jg-mjrx-434g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
CVE-2022-24772- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
Improper Verification of Cryptographic Signature in `node-forge`
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
CVE-2022-24772- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24772
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
DEBIAN-CVE-2022-24772- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in node-forge
Impact
RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used.
Patches
The issue has been addressed in node-forge 1.3.0.
References
For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at example email address
- Record
GHSA-x4jg-mjrx-434g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-24772
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.
- Record
UBUNTU-CVE-2022-24772- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1774916716 No score
TuxCare security update for node-forge (2 CVEs)
TuxCare rebuilt node-forge to address 2 CVEs. Fixed in 0.10.0-tuxcare.1.
- Record
CLSA-2026-1774916716- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2022-24772 No score
CVE-2022-24772 in node-forge - Patched by Root
Root has patched CVE-2022-24772 in the node-forge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2022-24772- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-forgenpm |
before 1.3.0 | 1.3.0 |
node-forgeTuxCare:npm From an advisory covering 2 CVEs |
0.10.0-tuxcare.0 up to 0.10.0-tuxcare.1, plus listed versions 0.10.0 |
0.10.0-tuxcare.1 |
node-node-forgeDebian:11 |
before 0.10.0~dfsg-3+deb11u1, plus listed versions 0.10.0~dfsg-3 |
0.10.0~dfsg-3+deb11u1 |
node-forgeRoot:npm |
before 0.10.0-aikido.2 | 0.10.0-aikido.20.7.1-aikido.20.7.1-aikido.30.7.1-aikido.40.7.6-aikido.10.10.0-aikido.30.7.1-aikido.50.7.1-aikido.60.7.1-aikido.70.7.6-aikido.20.9.0-aikido.11.0.0-aikido.10.9.0-aikido.20.10.0-aikido.41.3.0-aikido.11.3.0-aikido.21.3.0-aikido.31.3.0-aikido.4 |
@rootio/node-forgeRoot:npm |
before 0.7.1-root.io.2 | 0.7.1-root.io.20.10.0-root.io.20.10.0-root.io.10.7.1-root.io.10.7.1-root.io.30.7.1-root.io.40.7.6-root.io.10.10.0-root.io.30.7.1-root.io.50.7.1-root.io.60.7.1-root.io.70.7.6-root.io.20.9.0-root.io.11.0.0-root.io.10.9.0-root.io.20.10.0-root.io.41.3.0-root.io.21.3.0-root.io.11.3.0-root.io.31.3.0-root.io.4 |
node-node-forgeUbuntu:20.04:LTS |
All versions, plus listed versions 0.8.5~dfsg-20.9.1~dfsg-1 |
None known |
node-node-forgeUbuntu:22.04:LTS |
All versions, plus listed versions 0.10.0~dfsg-31.2.1~dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24772 is a high vulnerability (CVSS 7.5) in Digitalbazaar Forge, published March 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in node-forge 1.3.0.
References
github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1
nvd.nist.gov/vuln/detail/CVE-2022-24772