Forge’s Ed25519 verification accepts non‑canonical signatures where the scalar component S is not reduced modulo the group order. This missing check lets an attacker craft a signature that differs by the group order L, which still verifies correctly in forge but is invalid per the Ed25519 specification. The result is that applications trusting forge’s verification can accept forged signatures, enabling attackers to bypass authentication, authorization, and any signature‑based integrity checks such as deduplication or replay prevention. The weakness is a signature forgery vulnerability under CWE‑347.

Digitalbazaar’s node‑forge library is affected in all releases prior to version 1.4.0. Any Node.js application that imports forge for Ed25519 signature verification and relies on nonce or uniqueness checks is potentially vulnerable unless it has been updated to 1.4.0 or newer.

The CVSS score of 7.5 indicates a high impact with full privileges required by the signer. The EPSS score of less than 1 % suggests low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted signature that satisfies forge’s lenient verifier, most likely through a remote interface that processes signed data. Once the forged signature is accepted, the attacker can impersonate trusted users, elevate privileges, or tamper with data without detection.