{"id":"CVE-2026-48758","aliases":["CLSA-2026-1790597352","CLSA-2026-1792603628","CLSA-2026-1793143332","EUVD-2026-44501","GHSA-jfc7-64v2-mr8c","ROOT-APP-NPM-CVE-2026-48758"],"status":"published","title":"sigstore-js: DSSE payloadType type-binding failure","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00239,"percentile":0.14993,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-06-26T19:11:19Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"npm","package":"@sigstore/core","fixed_in":["3.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@sigstore/bundle","fixed_in":["2.0.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@sigstore/core","fixed_in":["2.0.0-tuxcare.1","3.2.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@sigstore/sign","fixed_in":["2.0.0-tuxcare.1","2.0.0-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@sigstore/tuf","fixed_in":["2.0.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"sigstore","fixed_in":["2.0.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/sigstore__core","fixed_in":["3.2.0-root.io.1","3.0.0-root.io.1","2.0.0-root.io.1","3.1.0-root.io.1","1.1.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@sigstore/core","fixed_in":["3.2.0-aikido.1","3.0.0-aikido.1","2.0.0-aikido.1","3.1.0-aikido.1","1.1.0-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@sigstore/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@sigstore/bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@sigstore/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@sigstore/sign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@sigstore/tuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"sigstore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@sigstore/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@sigstore/sign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.3"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"npm","package":"@sigstore/core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/sigstore__core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-root.io.1"},{"fixed":"3.0.0-root.io.1"},{"fixed":"2.0.0-root.io.1"},{"fixed":"3.1.0-root.io.1"},{"fixed":"1.1.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@sigstore/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-aikido.1"},{"fixed":"3.0.0-aikido.1"},{"fixed":"2.0.0-aikido.1"},{"fixed":"3.1.0-aikido.1"},{"fixed":"1.1.0-aikido.1"}]}]}],"products":[{"vendor":"sigstore","product":"sigstore-js"}],"references":[{"url":"https://github.com/sigstore/sigstore-js/security/advisories/GHSA-jfc7-64v2-mr8c","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/sigstore/sigstore-js/pull/1657","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/sigstore/sigstore-js/commit/b5aa4f1f8d2db0a9dfa6430fb114d9c2f1c304f7","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fcore%403.2.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-jfc7-64v2-mr8c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48758.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48758","tags":["advisory"]},{"url":"https://github.com/sigstore/sigstore-js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48758","title":"sigstore-js: DSSE payloadType type-binding failure","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.","status":"published","published":"2026-07-14T20:36:28.641Z","modified":"2026-07-15T12:54:55.445Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-44501","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.","status":"published","published":"2026-07-14T20:36:28Z","modified":"2026-07-15T12:54:55Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"ghsa":[{"id":"GHSA-jfc7-64v2-mr8c","title":"@sigstore/core has DSSE payloadType type-binding failure","description":"### Impact\nThe `preAuthEncoding` function in `@sigstore/core` uses Node.js `'ascii'` encoding when converting the PAE (Pre-Authentication Encoding) string to bytes. This allows `payloadType` to be mutated after signing without invalidating the signature, breaking the type-binding guarantee that DSSE is designed to provide.\n\nIn `packages/core/src/dsse.ts`, the PAE function builds a string containing `payloadType` and then encodes it with `Buffer.from(prefix, 'ascii')`.\n\nIn Node.js, `'ascii'` encoding for string-to-Buffer is equivalent to `'latin1'`, which **truncates characters above U+00FF to their low byte**. This means for any ASCII character, there exist Unicode characters (at U+01xx, U+02xx, etc.) that produce the identical encoded byte:\n\n| Original | Codepoint | Mutant | Codepoint | Encoded byte |\n|----------|-----------|--------|-----------|--------------|\n| `t`      | U+0074    | `Ŵ`    | U+0174    | `0x74`       |\n| `e`      | U+0065    | `ť`    | U+0165    | `0x65`       |\n\nAn attacker can substitute every character in `payloadType` with a Unicode variant whose low byte matches, producing **identical PAE bytes** and a passing signature verification.\n\nAdditionally, `payloadType.length` returns the JavaScript string length (UTF-16 code units) rather than the UTF-8 byte length required by the DSSE spec, though this is only a contributing factor for non-ASCII types.\n\n#### Reproduction\n\n```javascript\nconst { preAuthEncoding } = require('@sigstore/core/dist/dsse.js');\nconst payload = Buffer.from('hello world');\n\nconst original = preAuthEncoding('text/plain', payload);\n// U+01xx chars whose low bytes match the original ASCII chars\nconst mutant = preAuthEncoding('\\u0174\\u0165\\u0178\\u0174/\\u0170\\u016c\\u0161\\u0169\\u016e', payload);\n\nconsole.log('PAE bytes equal:', original.equals(mutant)); // true — should be false\n```","status":"published","published":"2026-06-26T19:11:19Z","modified":"2026-06-26T19:11:21Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:40:33.778544Z"}],"nvd":[{"id":"CVE-2026-48758","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.","status":"published","published":"2026-07-14T21:17:01.113Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-48758","title":"sigstore-js: DSSE payloadType type-binding failure","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.","status":"published","published":"2026-07-14T20:36:28.641Z","modified":"2026-10-28T02:30:39.270778Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-jfc7-64v2-mr8c","title":"@sigstore/core has DSSE payloadType type-binding failure","description":"### Impact\nThe `preAuthEncoding` function in `@sigstore/core` uses Node.js `'ascii'` encoding when converting the PAE (Pre-Authentication Encoding) string to bytes. This allows `payloadType` to be mutated after signing without invalidating the signature, breaking the type-binding guarantee that DSSE is designed to provide.\n\nIn `packages/core/src/dsse.ts`, the PAE function builds a string containing `payloadType` and then encodes it with `Buffer.from(prefix, 'ascii')`.\n\nIn Node.js, `'ascii'` encoding for string-to-Buffer is equivalent to `'latin1'`, which **truncates characters above U+00FF to their low byte**. This means for any ASCII character, there exist Unicode characters (at U+01xx, U+02xx, etc.) that produce the identical encoded byte:\n\n| Original | Codepoint | Mutant | Codepoint | Encoded byte |\n|----------|-----------|--------|-----------|--------------|\n| `t`      | U+0074    | `Ŵ`    | U+0174    | `0x74`       |\n| `e`      | U+0065    | `ť`    | U+0165    | `0x65`       |\n\nAn attacker can substitute every character in `payloadType` with a Unicode variant whose low byte matches, producing **identical PAE bytes** and a passing signature verification.\n\nAdditionally, `payloadType.length` returns the JavaScript string length (UTF-16 code units) rather than the UTF-8 byte length required by the DSSE spec, though this is only a contributing factor for non-ASCII types.\n\n#### Reproduction\n\n```javascript\nconst { preAuthEncoding } = require('@sigstore/core/dist/dsse.js');\nconst payload = Buffer.from('hello world');\n\nconst original = preAuthEncoding('text/plain', payload);\n// U+01xx chars whose low bytes match the original ASCII chars\nconst mutant = preAuthEncoding('\\u0174\\u0165\\u0178\\u0174/\\u0170\\u016c\\u0161\\u0169\\u016e', payload);\n\nconsole.log('PAE bytes equal:', original.equals(mutant)); // true — should be false\n```","status":"published","published":"2026-06-26T19:11:19Z","modified":"2026-09-10T03:51:08.786207433Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"CLSA-2026-1790597352","title":"TuxCare security update for 5 packages (1 CVE)","description":"TuxCare rebuilt 5 packages to address 1 CVE. Fixed in 2.0.0-tuxcare.1.","status":"published","published":"2026-09-28T12:09:12Z","modified":"2026-10-15T09:47:38.022595236Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792603628","title":"TuxCare security update for @sigstore/core (1 CVE)","description":"TuxCare rebuilt @sigstore/core to address 1 CVE. Fixed in 3.2.0-tuxcare.1.","status":"published","published":"2026-10-21T17:27:08Z","modified":"2026-10-21T20:30:50.503024056Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793143332","title":"TuxCare security update for @sigstore/sign (1 CVE)","description":"TuxCare rebuilt @sigstore/sign to address 1 CVE. Fixed in 2.0.0-tuxcare.3.","status":"published","published":"2026-10-27T23:22:12Z","modified":"2026-10-28T01:45:54.325675466Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"ROOT-APP-NPM-CVE-2026-48758","title":"CVE-2026-48758 in @rootio/sigstore__core - Patched by Root","description":"Root has patched CVE-2026-48758 in the @rootio/sigstore__core package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-28T11:37:55Z","modified":"2026-07-28T13:00:05.47050302Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}