A vulnerability in digitalbazaar forge (node-forge) prior to version 1.4.1 allows crafted DER input with nested BIT STRINGs to cause excessive recursion and resource consumption during ASN.1 decoding. This leads to high CPU usage and quadratic memory consumption, potentially resulting in denial of service. The issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows improper enforcement of the path length constraint in X.509 CA certificates when the keyUsage extension is missing. This can enable an attacker with control of a path-length-constrained CA private key or a subordinate CA certificate to create a certificate chain that exceeds the declared path length yet still passes verification. The issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows a remote attacker to cause a denial of service via uncontrolled recursion during TLS record processing. The recursive processing of TLS records consumes one JavaScript stack frame per record, enabling exhaustion of the call stack when thousands of small records are sent together. This issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge library (prior to version 1.4.1) involves improper input validation of PKCS#7 padding during CBC and ECB mode decryption. The library only validated the final byte of padding and accepted malformed padding, which could lead to silent removal of up to four plaintext blocks. This causes an integrity failure in applications relying on successful decryption as proof of valid padding. The issue is fixed in version 1.4.1.
A cryptographic signature verification flaw exists in digitalbazaar's forge library versions prior to 1.4.1. The vulnerability involves improper verification of the signature scheme, where the library incorrectly uses the issuer certificate's RSA padding and RSASSA-PSS parameters instead of those from the child certificate. This could allow a child certificate labeled as RSASSA-PSS to be accepted with a PKCS#1 v1.5 signature if the issuer uses PKCS#1 v1.5. The flaw does not allow certificate identity forgery but may bypass policies enforcing specific signature schemes. The issue is resolved in version 1.4.1.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed. Version 1.4.0 patches the issue.
Forge (node-forge) versions prior to 1.4.0 contain a vulnerability in the RSASSA PKCS#1 v1.5 signature verification process. The flaw allows attackers to forge signatures by inserting extra data within the ASN structure and by exploiting insufficient padding validation, enabling Bleichenbacher-style signature forgeries. This compromises the integrity and authenticity of communications relying on these signatures. Version 1.4.0 addresses this issue.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.