CVE-2026-48758: Sigstore Sigstore-Js

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.

Affected products

• Sigstore Sigstore-Js: before 3.2.1 (fixed in 3.2.1)

Published 2026-07-14. Last modified 2026-07-15.