CVE-2026-85393

About vulnerability

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.

Affected product:

@expo/build-tools , @ledgerhq/lumen-ui-rnative , AngularJS , Node.js , React , Vue , ai-sdk-harness-cline , ai-sdk-js , analog , analogjs-astro-angular , analogjs-platform , analogjs-vite-plugin-nitro , angular-devkit-build-angular , angular-pwa , astrojs-netlify , async-storage , aws-cdk , babel-plugin-remove-graphql-queries , babel-preset-expo , blockchain-link-utils , callstack-repack , cdk , celo-utils , celo-wallet-base , celo-wallet-hsm , celo-wallet-hsm-azure , celo-wallet-hsm-gcp , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , celo-wallet-rpc , chainsafe-libp2p-noise , clerk-clerk-expo , clerk-expo , clerk-expo-biometrics , clerk-expo-google-signin , clerk-expo-native-components , clerk-expo-passkeys , cline , cline-llms , cline-sdk , cline-shared , cloud-sdk-js , create-nuxt , create-react-app , create-rock , create-rspack , create-storybook , create-video , create-zephyr-apps , db , dev-middleware , developer-tooling , devtools , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-preset-classic , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , dotenvx-dotenvx , eas-cli , electron-webpack , eslint-config-expo , eslint-config-universe , ethereumjs-client , expo , expo-app-integrity , expo-app-intents , expo-app-loading , expo-apple-authentication , expo-application , expo-asset , expo-audio , expo-auth-session , expo-av , expo-background-fetch , expo-background-task , expo-barcode-scanner , expo-battery , expo-blur , expo-branch , expo-brightness , expo-build-properties , expo-calendar , expo-camera , expo-cli , expo-clipboard , expo-code-signing-certificates , expo-config , expo-configure-splash-screen , expo-constants , expo-contacts , expo-crypto , expo-dev-client , expo-dev-client-components , expo-dev-launcher , expo-dev-menu , expo-dev-menu-interface , expo-dev-server , expo-dev-tools , expo-device , expo-document-picker , expo-electron-adapter , expo-env-info , expo-error-recovery , expo-expo-cli , expo-file-system , expo-firebase-analytics , expo-firebase-core , expo-firebase-recaptcha , expo-font , expo-gl , expo-glass-effect , expo-google-app-auth , expo-haptics , expo-hinge , expo-image , expo-image-loader , expo-image-picker , expo-image-utils , expo-insights , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-authentication , expo-local-build-cache-provider , expo-localization , expo-location , expo-log-box-utils , expo-mail-composer , expo-manifests , expo-maps , expo-media-library , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-modules-cli , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-next-adapter , expo-notifications , expo-permissions , expo-pkcs12 , expo-prebuild-config , expo-print , expo-processing , expo-pwa , expo-random , expo-router , expo-router-server , expo-schemer , expo-screen-capture , expo-screen-orientation , expo-secure-store , expo-sensors , expo-sharing , expo-sms , expo-speech , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-store-review , expo-symbols , expo-system-ui , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-tracking-transparency , expo-updates , expo-updates-interface , expo-vector-icons , expo-video , expo-video-thumbnails , expo-web-browser , expo-webpack-config , expo-widgets , expo-xdl , expo-yarn-workspaces , gatsby , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , gax-nodejs , gcs-resumable-upload , google-ai-generativelanguage , google-api-nodejs-client , google-auth-library , google-cloud-common , google-cloud-kms , google-cloud-opentelemetry-cloud-monitoring-exporter , google-cloud-storage , google-p12-pem , googleapis-alertcenter , googleapis-common , googleapis-composer , googleapis-dataflow , googleapis-fcm , googleapis-forms , googleapis-gmail , googleapis-healthcare , googleapis-networkmanagement , googleapis-run , googleapis-sqladmin , googleapis-testing , grpc-grpc-js-xds , gtoken , guess , hiero-sdk-js , ipx , jest-expo , jest-expo-enzyme , jks-js , js-interfaces , js-libp2p , js-libp2p-bootstrap , js-libp2p-crypto , js-libp2p-kad-dht , js-peer-id , ledger-cosmos-js , ledger-live , ledgerhq-coin-algorand , ledgerhq-coin-aptos , ledgerhq-coin-canton , ledgerhq-coin-concordium , ledgerhq-coin-cosmos , ledgerhq-coin-near , ledgerhq-coin-polkadot , ledgerhq-crypto-icons , ledgerhq-domain-service , ledgerhq-hw-app-near , ledgerhq-hw-transport , ledgerhq-hw-transport-mocker , ledgerhq-hw-transport-node-hid-noevents , ledgerhq-hw-transport-node-speculos , ledgerhq-hw-transport-web-ble , ledgerhq-hw-transport-webusb , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-native-ui , libp2p , libp2p-interfaces-compliance-tests , listhen , livestore , livestore-webmesh , magic-js , mastra-auth-okta , mdx , microsoft-365-agents-toolkit , microsoft-rush , microsoft-rush-lib , mkcert , mockttp , modern-js-image , modern-js-plugin-polyfill , modern-js-tsconfig , modern.js , monorepo , netlify-aws-lambda-compat , netlify-dev , netlify-images , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , newman , nitro , nitroparty , node-forge , npm:gatsby-theme-blog-core , nuxt , nuxt-cli , nuxt-devtools-ui-kit , nuxt-docs , nuxt-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-schema , nuxt-test-utils , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , office-addin-debugging , office-addin-dev-settings , office-addin-scripts , okta-sdk-nodejs , onflow-fcl-react-native , opencensus-node , openllmetry-js , opentelemetry-operations-js , orama-orama , parcel-bundler , patch-project , postman-runtime , powersync-nuxt , primitives , remotion , remotion-animated-emoji , remotion-animation-utils , remotion-babel-loader , remotion-browser-bundler , remotion-bundler , remotion-captions , remotion-cli , remotion-cloudrun , remotion-codemods , remotion-compositor-darwin-arm64 , remotion-compositor-darwin-x64 , remotion-compositor-linux-arm64-gnu , remotion-compositor-linux-arm64-musl , remotion-compositor-linux-x64-gnu , remotion-compositor-linux-x64-musl , remotion-compositor-win32-x64-msvc , remotion-design , remotion-effects , remotion-elevenlabs , remotion-enable-scss , remotion-eslint-config , remotion-eslint-config-flat , remotion-eslint-plugin , remotion-fonts , remotion-gif , remotion-google-fonts , remotion-gsap , remotion-install-whisper-cpp , remotion-lambda , remotion-lambda-client , remotion-layout-utils , remotion-licensing , remotion-light-leaks , remotion-lottie , remotion-mac-cursors , remotion-maptiler , remotion-mcp , remotion-media , remotion-media-parser , remotion-media-utils , remotion-motion-blur , remotion-noise , remotion-openai-whisper , remotion-paths , remotion-player , remotion-preload , remotion-promo-pages , remotion-renderer , remotion-rive , remotion-rough-notation , remotion-rounded-text-box , remotion-sdk , remotion-serverless , remotion-serverless-client , remotion-sfx , remotion-shapes , remotion-skia , remotion-starburst , remotion-streaming , remotion-studio , remotion-studio-protocol , remotion-studio-server , remotion-studio-shared , remotion-svg-3d-engine , remotion-tailwind , remotion-tailwind-v4 , remotion-three , remotion-timeline-utils , remotion-transitions , remotion-vercel , remotion-video-matting , remotion-web-renderer , remotion-webcodecs , remotion-whisper-web , remotion-whisper-webgpu , remotion-zod-types , remotion-zod-types-v3 , repack , rock , rock-js-platform-apple-helpers , rock-js-plugin-brownfield-ios , rock-js-plugin-expo-config-plugins , rock-js-provider-github , rollup-plugin-zephyr , rsbuild-image , rspack , rspack-binding , rspack-cli , rspack-dev-server , rspack-test-tools , rushstack , rushstack-debug-certificate-manager , rushstack-heft-dev-cert-plugin , rushstack-heft-rspack-plugin , rushstack-heft-sass-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-heft-webpack5-plugin , rushstack-lookup-by-path , rushstack-rush-amazon-s3-build-cache-plugin , rushstack-rush-azure-storage-build-cache-plugin , rushstack-rush-bridge-cache-plugin , rushstack-rush-serve-plugin , sap-ai-provider , sap-ai-sdk-core , sap-ai-sdk-foundation-models , sap-ai-sdk-orchestration , sap-ai-sdk-prompt-registry , sap-cloud-sdk-http-client , sap-cloud-sdk-openapi , sap-cloud-sdk-resilience , sap-cloud-sdk-util , sb , selfsigned , sentry-astro , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-hono , sentry-javascript , sentry-nitro , sentry-node-native , sentry-nuxt , sentry-replay , sentry-server-runtime-injection , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-wasm , solana-wallet-adapter-base-ui , solidjs-start , sonarqube-scanner , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-onboarding , storybook-addon-pseudo-states , storybook-addon-themes , storybook-addon-vitest , storybook-angular , storybook-angular-vite , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-nextjs-vite , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-tanstack-react , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , svgr , svgr-babel-plugin-add-jsx-attribute , svgr-babel-plugin-remove-jsx-empty-expression , svgr-babel-plugin-replace-jsx-attribute-value , svgr-babel-plugin-svg-em-dimensions , svgr-babel-plugin-transform-react-native-svg , svgr-babel-plugin-transform-svg-component , svgr-babel-preset , svgr-core , svgr-hast-util-to-babel-ast , svgr-plugin-jsx , svgr-plugin-prettier , svgr-plugin-svgo , tanstack-browser-db-sqlite-persistence , tanstack-capacitor-db-sqlite-persistence , tanstack-cloudflare-durable-objects-db-sqlite-persistence , tanstack-expo-db-sqlite-persistence , tanstack-node-db-sqlite-persistence , tanstack-react-native-db-sqlite-persistence , tanstack-tauri-db-sqlite-persistence , theme-ui , trezor-blockchain-link-types , trezor-connect-web , trezor-suite , unimodules-permissions-interface , unimodules-sensors-interface , unimodules-task-manager-interface , unstorage , vinxi , vinxi-router , vinxi-server-components , vinxi-server-functions , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , wallet-adapter , webpack-dev-server , whistle , with-zephyr , xdl , zephyr-agent , zephyr-astro-integration , zephyr-edge-contract , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-native-cache , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-tap-runtime , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

gatsby-remark-images @ 3.3.33 (+10747 more)