GHSA-ppp5-5v6c-4jwp
HighAdvisory
Published 26 Mar 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.005
- 39th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 134
- of 17,781 indexed, latest versions
- Container images
- 129
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Carried by container images the latest versions of 134 of 17,781 indexed charts deploy, on 129 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| node-forgenpm | 0.7.1, 0.7.6, 0.8.0, 0.8.5+8 more | 1.4.0 | 129 |
- OSV records
- GHSA-ppp5-5v6c-4jwp
- Also known as
- CVE-2026-33894, CVE-2026-85393
Charts affected
134 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| wazuhwazuh-helm-morgovedVerified publisher | 2.0.7 | 1 of 5See more | 11,384 |
| lemmyananace-chartsVerified publisher | 0.6.15 | 1 of 5See more | 7,210 |
| chatwootchatwootVerified publisher | 2.0.24 | 1 of 3See more | 9,203 |
| n8nn8n | 0.23.0 | 1 of 1See more | 5,639 |
| sorry-cypresssorry-cypressVerified publisher | 1.20.0 | 1 of 4See more | 4,285 |
| wazuhwazuh-helmVerified publisher | 0.0.8 | 1 of 4See more | 6,168 |
| misskeyalytiVerified publisher | 1.0.0 | 1 of 1See more | 5,251 |
| backstagedeliveryheroVerified publisher | 0.1.15 | 1 of 2See more | 8,213 |
| wikijsgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 5,946 |
| klusterviewklusterviewVerified publisher | 0.1.0 | 1 of 4See more | 3,795 |
| kubeflowkubeflow | 1.6.2 | 1 of 45See more | 96,941 |
| kubernetes-loggingkubernetes-logging | 4.8.0 | 1 of 6See more | 10,530 |
| code-serveralekcVerified publisher | 0.1.1 | 1 of 1See more | 8,212 |
| nightscoutgabe565Verified publisher | 0.13.0 | 1 of 2See more | 2,521 |
| bitwarden-crd-operatorlerentisVerified publisher | 0.18.0 | 1 of 1See more | 2,003 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 18,517 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 4,016 |
| soarv113assist-iot-cybersecurity-monitoring-soar | 0.1.3 | 1 of 5See more | 17,896 |
| siemassist-iot-cybersecurity-monitroting-siem | 0.1.0 | 1 of 3See more | 10,730 |
| opensearch-dashboardscaptnbpVerified publisher | 2.2.1 | 1 of 1See more | 1,843 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 1 of 12See more | 38,346 |
| joplin-serverdjjudas21Verified publisher | 5.5.8 | 1 of 1See more | 3,925 |
| enbuildenbuildVerified publisher | 0.0.50 | 2 of 6See more | 31,510 |
| iobrokereugen | 0.2.6 | 1 of 1See more | 11,458 |
| ghostgeek-cookbookVerified publisher | 2.2.0 | 1 of 1See more | 4,260 |
| recipesgeek-cookbookVerified publisher | 6.6.2 | 1 of 2See more | 7,801 |
| sendgeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 1,148 |
| pdc-portali4trustVerified publisher | 2.3.2 | 1 of 1See more | 2,723 |
| elasticinseefrlab | 2.2.0 | 1 of 2See more | 17,284 |
| dashykrzwiatrzyk | 1.0.0 | 1 of 1See more | 3,143 |
| chatwootmaxcrm-chartsVerified publisher | 1.1.201 | 1 of 4See more | 5,940 |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 31,844 |
| kibanaromanow-helm-chartsVerified publisher | 1.7.1 | 1 of 1See more | 6,879 |
| jellyseerrrtomik-helm-chartsVerified publisher | 0.0.1 | 1 of 1See more | 2,823 |
| speckle-serverspeckleVerified publisher | 2.26.3 | 1 of 4See more | 10,380 |
| testhubteshubVerified publisher | 0.1.4 | 1 of 3See more | 7,517 |
| unitycatalogunitycatalogVerified publisher | 0.0.2 | 1 of 4See more | 12,581 |
| vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets | 0.0.0-main | 1 of 2See more | 4,010 |
| openhab-cloudandibraeuVerified publisher | 1.2.6 | 1 of 1See more | 3,437 |
| angular-chartangular-application | 0.1.0 | 1 of 1See more | 3,237 |
| apimap-developerapimapOfficialVerified publisher | 1.4.1 | 1 of 1See more | 2,353 |
| apimap-portalapimapOfficialVerified publisher | 2.4.0 | 1 of 1See more | 2,396 |
| trifidappuio | 2.0.2 | 1 of 1See more | 2,783 |
| openapiassist-iot-open-api-management | 0.2.2 | 1 of 6See more | 18,277 |
| astrotrekastria | 0.0.2 | 1 of 4See more | 32,501 |
| opendistro-esbeeinventor | 1.15.1 | 1 of 3See more | 5,806 |
| dv-podcharonOfficialVerified publisher | 0.19.1 | 1 of 5See more | 7,405 |
| ghostchart-ghost | 0.1.5 | 1 of 2See more | 4,083 |
| countlychristianhuthVerified publisher | 5.2.1 | 2 of 3See more | 7,295 |
| kube-slackcloudnativeapp | 1.0.0 | 1 of 1See more | 1,937 |
Container images carrying it
129 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| rcdelacruz/ | 38007f358355 | node-forge | 1.4.0 | 3 |
| agoldis/ | 10228ecd353b | node-forge | 1.4.0 | 2 |
| amazon/ | c740d7a89475 | node-forge | 1.4.0 | 2 |
| chatwoot/ | d530ab8c1753 | node-forge | 1.4.0 | 2 |
| martinaif/ | 43bc40a3da0e | node-forge | 1.4.0 | 2 |
| opensearchproject/ | 39695180364b | node-forge | 1.4.0 | 2 |
| stakater/ | 3f4926eedc74 | node-forge | 1.4.0 | 2 |
| ghcr.io/ | acb40032ad4b | node-forge | 1.4.0 | 2 |
| apimap/ | 406d3858e20c | node-forge | 1.4.0 | 1 |
| apimap/ | 041a4790c65c | node-forge | 1.4.0 | 1 |
| arfath29/ | 384b3e377f47 | node-forge | 1.4.0 | 1 |
| assistiot/ | 2297b4350211 | node-forge | 1.4.0 | 1 |
| assistiot/ | 0570b27bb7c2 | node-forge | 1.4.0 | 1 |
| assistiot/ | f11d82defc70 | node-forge | 1.4.0 | 1 |
| ccjacobs14/ | 9a9b14a6f09e | node-forge | 1.4.0 | 1 |
| chatwoot/ | 67ebc751c171 | node-forge | 1.4.0 | 1 |
| codercom/ | 1e2cc688008e | node-forge | 1.4.0 | 1 |
| coldatom/ | 7c2fbbb41bcf | node-forge | 1.4.0 | 1 |
| conduction/ | d591f5e6f2a9 | node-forge | 1.4.0 | 1 |
| countly/ | f4cc7447c4f5 | node-forge | 1.4.0 | 1 |
| countly/ | e3c238248f99 | node-forge | 1.4.0 | 1 |
| countly/ | 2acbc11499b6 | node-forge | 1.4.0 | 1 |
| cryptexlabs/ | 189c07411d7c | node-forge | 1.4.0 | 1 |
| dessalines/ | ee4c620d8e93 | node-forge | 1.4.0 | 1 |
| directus/ | e3c8bb975350 | node-forge | 1.4.0 | 1 |
| enketo/ | dcad9c2273f6 | node-forge | 1.4.0 | 1 |
| fallenbagel/ | 4538137bc5af | node-forge | 1.4.0 | 1 |
| fiware/ | a1b6ed4ae84f | node-forge | 1.4.0 | 1 |
| gristlabs/ | 6e71b1914a7e | node-forge | 1.4.0 | 1 |
| hecrom/ | 5454b54d5b28 | node-forge | 1.4.0 | 1 |
| helga09/ | 7999bc8b77c0 | node-forge | 1.4.0 | 1 |
| henrywhitaker3/ | 47159a940229 | node-forge | 1.4.0 | 1 |
| i4trust/ | 3e77858e1219 | node-forge | 1.4.0 | 1 |
| ibarreche/ | c8970ac1c8dc | node-forge | 1.4.0 | 1 |
| joplin/ | 52af57880c0e | node-forge | 1.4.0 | 1 |
| joplin/ | b87564ef34e9 | node-forge | 1.4.0 | 1 |
| kobotoolbox/ | bcacc01bccd4 | node-forge | 1.4.0 | 1 |
| kubeflownotebookswg/ | 37300551dea6 | node-forge | 1.4.0 | 1 |
| kubeflownotebookswg/ | af55c22ef5de | node-forge | 1.4.0 | 1 |
| kyleslugg/ | ba8c36dfdfbd | node-forge | 1.4.0 | 1 |
| leonardomulticloud/ | e42a341e0299 | node-forge | 1.4.0 | 1 |
| library/ | 2654b1e90413 | node-forge | 1.4.0 | 1 |
| library/ | 767230c0f263 | node-forge | 1.4.0 | 1 |
| library/ | 83f7bf209844 | node-forge | 1.4.0 | 1 |
| library/ | ac533a6988ee | node-forge | 1.4.0 | 1 |
| library/ | 0172f1c538e7 | node-forge | 1.4.0 | 1 |
| library/ | 04c0fc150f3a | node-forge | 1.4.0 | 1 |
| library/ | c5781ba340ef | node-forge | 1.4.0 | 1 |
| library/ | e2e2031c15be | node-forge | 1.4.0 | 1 |
| linuxserver/ | a5e43a05ae79 | node-forge | 1.4.0 | 1 |