Is CVE-2026-33895 actively exploited?

No active exploitation of CVE-2026-33895 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33895 be exploited remotely?

Yes. CVE-2026-33895 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33895?

CVE-2026-33895 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-33895

HIGH

CVE-2026-33895

CWE-347Published: March 27, 2026· Updated: Mar 31, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:10.1th

Official Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.

NVD Source

Technical Analysis

CVE-2026-33895 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.