Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

Untriaged
Filter by:
With package: python313Packages.browserforge

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-85393
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 2 weeks, 3 days ago Activity log
  • Created suggestion 2 weeks, 3 days ago
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.

Affected products

forge
  • =<1.4.0

Matching in nixpkgs

pkgs.forgejo

Self-hosted lightweight software forge

  • nixos-unstable -
  • nixos-26.05 -

pkgs.forge-mtg

Magic: the Gathering card game with rules enforcement

  • nixos-unstable -
  • nixos-26.05 -

pkgs.forgejo-cli

CLI application for interacting with Forgejo

  • nixos-unstable -
    • nixos-unstable-small 0.6.0
  • nixos-26.05 -
    • nixos-26.05-small 0.6.0

pkgs.forgejo-lts

Self-hosted lightweight software forge

  • nixos-unstable -
  • nixos-26.05 -

pkgs.forgejo-mcp

Model Context Protocol (MCP) server for interacting with the Forgejo REST API

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mcdreforged

Minecraft server control tool

  • nixos-unstable -
  • nixos-26.05 -

pkgs.forge-sparks

Get Git forges notifications

  • nixos-unstable -
    • nixos-unstable-small 1.0.1
  • nixos-26.05 -
    • nixos-26.05-small 1.0.1

pkgs.forgejo-runner

Runner for Forgejo based on act

  • nixos-unstable -
  • nixos-26.05 -