The flaw lies in forge’s implementation of RSASSA PKCS#1 v1.5 signature verification. Before version 1.4.0, the library accepts malformed ASN.1 structures that contain additional “garbage” bytes inside the signature’s ASN.1 field. When the RSA public exponent is small (e = 3), an attacker can craft a signature that satisfies the verification routine while actually being entirely user‑controlled. The defect also allows forging signatures that lack the required minimum eight bytes of padding, creating a Bleichenbacher‑style forgery path. Consequently, any system that relies on forge to verify signed data can be deceived into accepting attacker‑generated signatures, potentially compromising authentication or integrity of protected content.

The vulnerability affects all releases of the Digital Bazaar node‑forge library before version 1.4.0. Any JavaScript application—client‑side or server‑side—that uses forge for Transport Layer Security or RSA signature verification is at risk if it does not upgrade to the patched release.

With a CVSS base score of 7.5, the vulnerability poses a high impact. The exploitation model is straightforward: an adversary can generate a forged signature for any public key with a low exponent, and any consumer of forge that performs signature validation will accept it as legitimate. No EPSS score is documented, and the flaw has not been listed in the CISA KEV catalog. Given the ubiquity of node‑forge in web and server applications, the risk of real‑world exploitation remains significant.