GHSA-x3ff-w252-2g7j

# Ed25519 Signature Malleability via Missing S < L Check -- Same Class as node-forge CVE-2026-33895 (CWE-347) ## Target - Repository: StableLib/stablelib (package: @stablelib/ed25519) - Platform: GitHub PVR - Bounty: CVE credit - CWE: CWE-347 (Improper Verification of Cryptographic Signature) - Version: 2.0.2 (latest, 2026-03-28) ## Root Cause The `verify()` function in `@stablelib/ed25519` does not check that the `S` component of the signature is less than the group order `L`. Per CFRG recommendations and the ZIP-215 specification, Ed25519 implementations should reject signatures where `S >= L` to prevent signature malleability. When `S >= L`, `[S]B = [(S mod L)]B = [(S - L)]B`, meaning two different 32-byte `S` values produce the same verification result. An attacker who observes a valid signature `(R, S)` can produce a second valid signature `(R, S + L)` for the same message. ### Vulnerable code **File:** `packages/ed25519/ed25519.ts` (compiled: `lib/ed25519.js:779-802`) ```javascript export function verify(publicKey, message, signature) { // ... length check, unpack public key ... const hs = new SHA512(); hs.update(signature.subarray(0, 32)); // R hs.update(publicKey); // A hs.update(message); // M const h = hs.digest(); reduce(h); // h is reduced mod L scalarmult(p, q, h); // [h](-A) scalarbase(q, signature.subarray(32)); // [S]B -- S NOT checked or reduced edadd(p, q); pack(t, p); if (verify32(signature, t)) { // compare R return false; } return true; } ``` Note that `h` is properly `reduce()`d (line 794), but `S` (signature bytes 32-63) is passed directly to `scalarbase()` without any range check. ## Proof of Concept ```javascript const ed = require('@stablelib/ed25519'); const kp = ed.generateKeyPair(); const msg = new TextEncoder().encode("Hello, world!"); const sig = ed.sign(kp.secretK