https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33896.htmlhttps://patchthecve.com/cve/CVE-2026-33896.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.4: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extehttps://patchthecve.com/cve/CVE-2026-33895.htmlhttps://patchthecve.com/cve/CVE-2026-33895.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.5: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L`https://patchthecve.com/cve/CVE-2026-33894.htmlhttps://patchthecve.com/cve/CVE-2026-33894.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing “garbage” bytes within thehttps://patchthecve.com/cve/CVE-2026-33891.htmlhttps://patchthecve.com/cve/CVE-2026-33891.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.5: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn lib