CVE-2022-24773
Improper Verification of Cryptographic Signature in `node-forge`
Reported by github_m · Published March 18, 2022
node-forge is fixed in 1.3.0 (npm)
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| node-forge | npm | 1.3.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| digitalbazaar | forge | < 1.3.0 |
| npm | node-forge | 0 |
| digitalbazaar | forge | 0 |
| npm | forge | 0 |
Timeline
- Mar 18, 2022 CVE Published
- Mar 19, 2022 EPSS Score (30 in total, the first dated here)
- Apr 7, 2022 PoC Published (8 in total, the first dated here)
- Nov 21, 2024 CVE Updated
- Mar 9, 2026 Security Advisory (22 in total, the first dated here)
- Mar 17, 2026 Distribution Patch (21 in total, the first dated here)
- Jul 2, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-24773
vulnetix vdb fixes CVE-2022-24773Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-24773/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- x_refsource_CONFIRM
- x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2022-24773 advisory
- https://github.com/advisories/GHSA-2r2c-g63r-vccr advisory