[nitrog7]

RSA PKCS#1 v1.5 verification accepts unconsumed fields inside the nested DigestAlgorithm sequence. Enforce its exact OID/optional-NULL element count and require a present NULL value to be empty. This closes the documented nested-element bypass and prevents garbage being carried inside the NULL itself.

References: CVE-2026-85393 / GHSA-86w9-cpqp-85rv, #1149, and the element-count proposal in #1152. The additional empty-NULL check matters: applying only #1152's count check still accepts the new nonempty-NULL regression. Existing SHA parameter-omission acceptance and the MD5 requirement for NULL parameters are preserved. No RSA arithmetic or padding algorithm changes.

The 14 new regression/compatibility tests sign deliberately structured DigestInfo values with an existing fixture private key and verify using the normal public verifier, including normal padding and trailing-byte checks. They demonstrate the verification parser gap; they do not claim to generate a signature forgery without the private key.

Validation on Node 24.15.0 / macOS:

• New regression suite on upstream 1.4.0: 9 passing, 5 failing (malformed encodings accepted).
• With only the nested count check from Fix RSA PKCS#1 v1.5 forgery via nested DigestAlgorithm garbage #1152: 13 passing, 1 failing (nonempty NULL still accepted).
• With this change: 14 passing.
• npm run test-node -- --forbid-only: 842 passing, 4 pending.
• mocha -t 30000 tests/unit/rsa.js --forbid-only: 114 passing, 4 pending.
• ESLint diagnostics for both changed files match upstream main exactly: 94 existing errors and 9 existing warnings; no new diagnostics. The existing lint baseline is not modified.

The four pending RSA tests are pre-existing. Browser testing and the full upstream Node-version matrix were not run. Package metadata and licensing are unchanged.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.27%. Comparing base (7232404) to head (8544680).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1161      +/-   ##
==========================================
+ Coverage   80.25%   80.27%   +0.02%     
==========================================
  Files          42       42              
  Lines        9597     9597              
==========================================
+ Hits         7702     7704       +2     
+ Misses       1895     1893       -2     

Files with missing lines	Coverage Δ
lib/rsa.js	78.46% <ø> (+0.38%)	⬆️

... and 2 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7232404...8544680. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[davidlehn]

Thank you. Your test ideas, including the per-hash and MD5 NULL parameter cases, are in node-forge 1.4.1's tests, and you're credited in GHSA-2g46-22mc-6gwp. The fix uses canonical re-encoding rather than element checks, so this PR isn't merged. Closing.