CVE Details
| CVE ID |
Severity |
Affected Package |
Installed Version |
Fixed Version |
Date Published |
Date of Scan |
| CVE-2026-48758 |
MEDIUM |
@sigstore/core |
2.0.0 |
3.2.1 |
2026-07-14T21:17:01.113Z |
2026-07-15T10:18:18.360065213Z |
Affected Docker Images
| Image Name |
SHA |
public.ecr.aws/lambda/nodejs:22 |
public.ecr.aws/lambda/nodejs@sha256:4330d56e02e084caa74a94ed3ce6b16c5d5e00fd2bc11bbfcb8d7de8357f5471 |
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
Remediation Steps
- Update the affected package
@sigstore/core from version 2.0.0 to 3.2.1.
About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit Lambda Watchdog.
- This issue was created automatically by Lambda Watchdog.
CVE Details
MEDIUM@sigstore/core2.0.03.2.12026-07-14T21:17:01.113Z2026-07-15T10:18:18.360065213ZAffected Docker Images
public.ecr.aws/lambda/nodejs:22public.ecr.aws/lambda/nodejs@sha256:4330d56e02e084caa74a94ed3ce6b16c5d5e00fd2bc11bbfcb8d7de8357f5471Description
Remediation Steps
@sigstore/corefrom version2.0.0to3.2.1.About this issue