VDB

CVE-2026-85393

CVE-2026-85393 PUBLISHED CVSS 8.7 HIGH

Reported by vulncheck · Published September 3, 2026

node-forge is fixed in 1.4.0 (npm)

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
node-forgenpm1.4.0
dotstatsuite-supercoreChainguard3.1.0_git20261022-r4
commercial-gitlab-rails-ee-fips-19.2Chainguard19.2.7-r1
gitlab-rails-ce-fips-18.10Chainguard18.10.8-r8
kubeflow-centraldashboardWolfi2.0.0-r8
opensearch-dashboards-3Wolfi3.9.0-r5
commercial-gitlab-rails-ee-fips-19.4Chainguard19.4.1-r1
commercial-gitlab-rails-ee-fips-19.3Chainguard19.3.3-r1
kubeflow-pipelinesWolfi2.17.2-r17
gitlab-rails-ce-fips-18.11Chainguard18.11.12-r2
commercial-gitlab-rails-ee-fips-19.1Chainguard19.1.9-r0
commercial-gitlab-rails-ee-19.3Chainguard19.3.3-r1

11 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products

VendorProductVersions
digitalbazaarforge0
chainguarddotstatsuite-supercore0
chainguardcommercial-gitlab-rails-ee-fips-19.20
chainguardgitlab-rails-ce-fips-18.100
wolfikubeflow-centraldashboard0
wolfiopensearch-dashboards-30
chainguardcommercial-gitlab-rails-ee-fips-19.40
chainguardcommercial-gitlab-rails-ee-fips-19.30
wolfikubeflow-pipelines0
chainguardgitlab-rails-ce-fips-18.110
chainguardcommercial-gitlab-rails-ee-fips-19.10
chainguardcommercial-gitlab-rails-ee-19.30
chainguardcommercial-gitlab-rails-ee-19.40
chainguardgitlab-rails-ce-fips-19.00
chainguardcommercial-gitlab-rails-ee-19.20
chainguardgitlab-rails-ce-fips-18.90
wolfijitsucom-jitsu0
digitalbazaarforge
chainguardcommercial-gitlab-rails-ee-19.10
chainguardgitlab-rails-ce-19.30

…and 5 more

Timeline

  • Sep 3, 2026 CVE Published
  • Sep 3, 2026 CVE Updated
  • Sep 4, 2026 EPSS Score (19 in total, the first dated here)
  • Oct 31, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-85393
vulnetix vdb fixes CVE-2026-85393

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-85393/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›