CVE-2026-33895 node-forge签名验证绕过漏洞

const forge = require('node-forge'); const { Ed25519 } = require('@noble/ed25519'); // Using noble for correct math if needed // Simulate a valid signature generation (normally done by legitimate user) const privateKey = '...'; // Private key hex const message = 'Important Message'; // 1. Generate a valid signature (Conceptual) // const signature = Ed25519.sign(message, privateKey); // 2. Exploit: Create a non-canonical signature // Ed25519 signatures are (R, S). The order L is 2^252 + ... // In the vulnerable forge, S can be S + L and still verify. // Mocking the verification bypass logic function verifyBypass(vulnerableSignature) { // Imagine vulnerableSignature has S' = S + L // Vulnerable forge code: // return forge.pki.ed25519.verify({ ... signature: vulnerableSignature }); console.log('Vulnerable library accepts S+L signature: True'); } // Standard library (Node.js crypto) rejects S+L function standardVerify(vulnerableSignature) { // Node.js crypto.verify returns false for S+L console.log('Standard library rejects S+L signature: False'); } verifyBypass('forged_signature_bytes'); standardVerify('forged_signature_bytes');