CVE-2026-48758

Name of the Vulnerable Software and Affected Versions sigstore-js versions prior to 3.2.1

Description The preAuthEncoding() function in @sigstore/core uses Node.js ascii encoding when converting the Pre-Authentication Encoding (PAE) string to bytes. Because ascii encoding in Node.js truncates characters above U+00FF to their low byte, an attacker can substitute characters in the payloadType variable with Unicode variants that produce identical encoded bytes. This allows the payloadType to be mutated after signing without invalidating the signature, which breaks the type-binding guarantee provided by Dead Simple Signing Envelope (DSSE), a standard for signing arbitrary data.

Recommendations Update sigstore-js to version 3.2.1.