zcap has incomplete expiration checks in capability chains.
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.
Summary
`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is not properly checked against the current date or other `date` param. This can allow invocations outside of the original intended time period. A zcap still cannot be invoked without being able to use the associated private key material. `@digitalbazaar/zcap` v9.0.1 fixes expiration checking. As a workaround, one may revoke a zcap at any time.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| digitalbazaar | zcap | before 9.0.1 | 9.0.1 | Patch available | CNA |
| — | @digitalbazaar/zcap (npm) | before 9.0.1 | 9.0.1 | Patch available | GHSA-hp8h-7x69-4wmv |
- zcap Vendordigitalbazaar Affected before 9.0.1 Fixed in 9.0.1 Patch available CNA
- @digitalbazaar/zcap (npm) Vendor— Affected before 9.0.1 Fixed in 9.0.1 Patch available GHSA-hp8h-7x69-4wmv
Remediation
- Fix · CNA zcap (digitalbazaar) Fixed in 9.0.1
- Fix · GHSA-hp8h-7x69-4wmv @digitalbazaar/zcap (npm) Fixed in 9.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-31995
- 2026-10-03 Alias added: GHSA-hp8h-7x69-4wmv
References
Other 5
- https://github.com/digitalbazaar/zcap/security/advisories/GHSA-hp8h-7x69-4wmv
- https://github.com/digitalbazaar/zcap/pull/82
- https://github.com/digitalbazaar/zcap/commit/261eea040109b6e25159c88d8ed49d3c37f8fcfe
- https://github.com/digitalbazaar/zcap/commit/55f8549c80124b85dfb0f3dcf83f2c63f42532e5
- https://github.com/digitalbazaar/zcap
More digitalbazaar vulnerabilities
- TI-2026-58601 node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding CVSS 4.0HIGH 8.7
- TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
- TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
- TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
- TI-2026-82733 Forge accepts zero iteration count, enabling PKCS#12 integrity bypass CVSS 3.1HIGH 7.5
- TI-2026-82730 Regular expression denial of service in Forge PEM decoding CVSS 3.1HIGH 7.5
Sources
- CVE-2024-31995 · CVE Program
- CVE-2024-31995 · NVD
- FIRST EPSS
- GHSA-hp8h-7x69-4wmv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences