{"affected":[{"product":"forge","source":"CNA: GitHub_M","vendor":"digitalbazaar","versions":[{"status":"affected","version":"< 1.4.3"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"node-forge","product":"node-forge","source":"OSV GHSA-6889-vf6x-f3g5","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"1.4.3"}],"lessThan":"1.4.3","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-125335","cwes":["CWE-347"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can choose the public key can produce signatures that verify for many messages, or all messages with the identity key, without a private key. This can defeat proof-of-possession, attribution, non-repudiation, or deduplication checks that rely on a signature being bound to the message. Keys produced by normal Ed25519 key generation are not small-order, so applications that verify only trusted or internally generated public keys are not affected. This issue is fixed in version 1.4.3.","epss":{"date":"2026-11-12","percentile":0.10343,"score":0.00203},"exploits":[],"kev":null,"metrics":[{"score":3.7,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":3.7,"severity":"low","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794506533877,"publishedAt":1794336674503,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-6889-vf6x-f3g5"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-6889-vf6x-f3g5"}],"remediation":[{"kind":"fix","source":"OSV GHSA-6889-vf6x-f3g5","text":"node-forge (npm): OSV reports a fixed version 1.4.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-6889-vf6x-f3g5"}],"revision":"2668d9104541435bee51a48076ca969b19dedfefb52449c9902f8b1bd65eeb93","sources":[{"modifiedAt":1794506533877,"name":"CNA: GitHub_M","retrievedAt":1794510570719,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125335"},{"modifiedAt":1794347191913,"name":"NVD","retrievedAt":1794356904703,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125335"},{"modifiedAt":1794346203999,"name":"OSV / GitHub Security Advisories","retrievedAt":1794510571122,"url":"https://osv.dev/vulnerability/GHSA-6889-vf6x-f3g5"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794510584610,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-125335"}],"ssvc":{"assessedAt":1794500775409,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Forge: Ed25519 signature verification accepts small-order public keys","updatedAt":1794510584610}