CVE-2026-48758CWE-347

sigstore-js: DSSE payloadType type-binding failure

Medium · published July 14, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-07-14T20:36Z
EPSS history
Timeline
  • 14 JUL 20:36Z
    sigstore-js: DSSE payloadType type-binding failure
    cvelistv5