High severity7.5NVD Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-48815
CVE-2026-48815
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sigstorenpm | < 4.1.1 | 4.1.1 |
Affected products
4- osv-coords3 versionspkg:apk/chainguard/graalvm-25-ce-nodejspkg:apk/chainguard/pulumi-language-nodejspkg:apk/wolfi/pulumi-language-nodejs
< 25.0.3-r9+ 2 more
- (no CPE)range: < 25.0.3-r9
- (no CPE)range: < 3.248.0-r2
- (no CPE)range: < 3.248.0-r2
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-52v5-jr5w-gjxrghsaADVISORY
- github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxrnvdWEB
- github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52bnvd
- github.com/sigstore/sigstore-js/pull/1658nvd
- github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1nvd
News mentions
0No linked articles in our index yet.