CVE-2026-48758: sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding fu…
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
- Published by source
- 2026-07-14
- First seen by Reality Radar
- 2026-10-25
- Last verified
- 2026-10-25
What the official notice says
Risk: CVSS 5.4
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-07-14
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1629 | new | 2026-10-25 | cc3d4b513b18…d0ac31 | 7d15718104cf…1dc297 |
Chain head: #1648 cafd57e2dfc3…bbd03d