Skip to content
OpenAdvisories
Medium DSA-5539-1 1 CVE

node-browserify-sign - security update

Published Oct 30, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 11 node-browserify-sign 4.2.1-1+deb11u1
Debian · 12 node-browserify-sign 4.2.1-3+deb12u1

Vulnerabilities 1

  • Medium 6.5
    CVE-2023-46234

    browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack

    browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures t…

    browserify browserify-sign reaper node-browserify-sign Debian Ubuntu Azure Linux npm