CVE-2026-33895

Forge has signature forgery in Ed25519 due to missing S > L check

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.

We have discovered 514 live websites that are affected by CVE-2026-33895.

Run a Free Instant Scan



Affected Software

Product  node-forge
Category JavaScript Libraries
Vulnerable Domains514 live websites (100% of node-forge install base)
Vulnerable Versions
  • from 0 through 1.4
Vulnerable Versions Count5 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-347 Improper Verification of Cryptographic Signature



Details

  • Published - Mar 27, 2026
  • Updated - Mar 31, 2026

Website Distribution by Country

Number of websites using CVE-2026-33895
United States357 websites


China39 websites
Germany17 websites
Netherlands12 websites
Italy9 websites
GB8 websites
Hong Kong7 websites
Poland6 websites
Brazil6 websites
Canada5 websites

Website Distribution by TLD

Number of websites using CVE-2026-33895
.com287 websites
.cn36 websites
.de16 websites
.nl13 websites
.it11 websites
.org11 websites
.net9 websites
.co8 websites
.io7 websites
.pl7 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-33895

Top websites that are affected by CVE-2026-33895. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.com United States**,***
*******.com GB**,***
*********.com United States***,***
*******.com United States***,***
******.com United States***,***
********.com United States***,***
*******.com United States***,***
************.com Hong Kong***,***
*************.com United States***,***
*******.co United States***,***
See full domain list

FAQ

CVE-2026-33895 is Improper Verification of Cryptographic Signature in node-forge
A total of 514 websites have been identified as vulnerable to CVE-2026-33895, based on global website indexing conducted by WebTechSurvey.
The node-forge is affected by the CVE-2026-33895 vulnerability.
node-forge versions up to 1.4 are vulnerable to CVE-2026-33895.
CVE-2026-33895 is resolved in version 1.4 of node-forge.