CVE-2026-48815

EUVD-2026-44494
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.62%
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
nodejs24
Amazon Linux 2023
1:24.18.0-1.amzn2023.0.1
fixed
nodejs24-debuginfo
Amazon Linux 2023
1:24.18.0-1.amzn2023.0.1
fixed
nodejs24-debugsource
Amazon Linux 2023
1:24.18.0-1.amzn2023.0.1
fixed
nodejs24-devel
Amazon Linux 2023
1:24.18.0-1.amzn2023.0.1
fixed
nodejs24-docs
Amazon Linux 2023
1:24.18.0-1.amzn2023.0.1
fixed
nodejs24-full-i18n
Amazon Linux 2023
1:24.18.0-1.amzn2023.0.1
fixed
nodejs24-libs
Amazon Linux 2023
1:24.18.0-1.amzn2023.0.1
fixed
nodejs24-libs-debuginfo
Amazon Linux 2023
1:24.18.0-1.amzn2023.0.1
fixed
nodejs24-npm
Amazon Linux 2023
1:11.16.0-1.24.18.0.1.amzn2023.0.1
fixed
v8-13.6-devel
Amazon Linux 2023
3:13.6.233.17-1.24.18.0.1.amzn2023.0.1
fixed
Common Weakness Enumeration
References
https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b
https://github.com/sigstore/sigstore-js/pull/1658
https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr