CVE-2026-33895: Forge has signature forgery in Ed25519 due to missing S > L check
(updated )
Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (S >= L). A valid signature and its S + L variant both verify in forge, while Node.js crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed.
References
- datatracker.ietf.org/doc/html/rfc8032
- github.com/advisories/GHSA-q67f-28xg-22rw
- github.com/digitalbazaar/forge
- github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85
- github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw
- nvd.nist.gov/vuln/detail/CVE-2022-35961
- nvd.nist.gov/vuln/detail/CVE-2026-25793
- nvd.nist.gov/vuln/detail/CVE-2026-33895
Code Behaviors & Features
Detect and mitigate CVE-2026-33895 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →