Read the docs
TI-2022-08585 Aliases CVE-2022-24771GHSA-cfm4-qjh2-4765

Improper Verification of Cryptographic Signature in node-forge

Priority MEDIUM 40CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 4 fixed, 15 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00779 56th percentileScored 2026-11-07
Fix Partial forge (digitalbazaar): 1.3.0node-forge (npm): 1.3.0Red Hat: 5 advisoriesRed Hat: 4 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
digitalbazaarforgebefore 1.3.01.3.0Patch availableCNA
—node-forge (npm)before 1.3.01.3.0Patch availableGHSA-cfm4-qjh2-4765
  • forge Vendordigitalbazaar Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
  • node-forge (npm) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-cfm4-qjh2-4765

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:*before 1.3.0Vulnerabledigitalbazaar
  • cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:* Versions before 1.3.0 Vulnerable ·digitalbazaar

Remediation

  • Fix · CNA forge (digitalbazaar) Fixed in 1.3.0
  • Fix · GHSA-cfm4-qjh2-4765 node-forge (npm) Fixed in 1.3.0 Advisory →

Red Hat 5 advisories

  • RHSA-2022:6835 Released 2022-10-06 · Red Hat rating Important
    Service Registry (container images) release and security update [2.3.0.GA]
    • RHINT Service Registry 2.3.0 GA
  • RHSA-2022:6813 Released 2022-10-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.1 security update
    • RHPAM 7.13.1 async
  • RHSA-2022:6156 Released 2022-08-24 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
    • RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
Show 2 more Red Hat advisories
  • RHSA-2022:1739 Released 2022-05-05 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.1.2.1 containers security update
    • OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
  • RHSA-2022:1681 Released 2022-05-03 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Integration Data Virtualisation OperatorAffectedNo fix planned: Out of support scope
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 2AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.1Fixed RHSA-2022:1739
RHINT Service Registry 2.3.0 GAFixed RHSA-2022:6835
RHODF 4.11 for RHEL 8Fixed RHSA-2022:6156
RHPAM 7.13.1 asyncFixed RHSA-2022:6813
Not affected: 10 products
  • OpenShift Developer Tools and Services
  • OpenShift Service Mesh 2.1
  • RHODF 4.11 for RHEL 8
  • Red Hat A-MQ Online
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Data Grid 8
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24771
  2. 2026-10-03 Alias added: GHSA-cfm4-qjh2-4765

References

Patch 1

Advisory 2

Other 2

  • TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
  • TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
  • TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-26253 Forge has signature forgery in Ed25519 due to missing S > L check CVSS 3.1HIGH 7.5
  • TI-2026-26252 Forge has signature forgery in RSA-PKCS due to ASN.1 extra field CVSS 3.1HIGH 7.5
  • TI-2026-26249 Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences