- Severity: LOW
- CVE: CVE-2026-118774
- Ecosystems: npm
- Packages: node-forge
### Summary
When verifying a certificate, node-forge chose the RSA padding scheme (PKCS#1 v1.5 or RSASSA-PSS) and PSS parameters from the issuer certificate’s own signature algorithm instead of the certificate being verified. A certificate labeled as signed with RSASSA-PSS could pass `verifyCertificateChain()` with a PKCS#1 v1.5 signature. Fixed in node-forge 1.4.1.
### Details
`certificate.verify(child)` in `lib/x509.js` hashes the child’s TBSCertificate with the digest of the child’s signature algorithm, then calls `_verifySignature()` with the issuer certificate. `_verifySignature()` selected the padding scheme from that certificate’s `signatureOid` and `signatureParameters`, so the child was verified with the issuer’s own scheme rather than the one the child declares.
As a result, a child certificate whose signature algorithm says RSASSA-PSS was accepted with a PKCS#1 v1.5 signature when the issuer itself was signed with PKCS#1 v1.5. The outer `signatureAlgorithm` field of a certificate is not covered by the signature, so an existing PKCS#1 v1.5 (SHA-256) certificate can be relabeled as RSASSA-PSS and still pass verification. The signature itself must still be made with the issuer’s private key over the certificate’s contents; no certificate can be forged.
The same cause made correctly signed chains fail: a PKCS#1 v1.5 certificate issued by an RSASSA-PSS-signed certificate, or the reverse, was rejected.
The fix verifies with the child certificate’s signature scheme…
Source: GitHub Security Advisories · 2026-11-10