A vulnerability in digitalbazaar's forge library prior to version 1.4.3 allows improper validation of the X.509 nameConstraints extension during certificate chain verification. This flaw permits a name-constrained certificate authority with a non-critical extension to issue certificates outside permitted namespaces, potentially enabling impersonation of unauthorized names. The issue is fixed in version 1.4.3.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can choose the public key can produce signatures that verify for many messages, or all messages with the identity key, without a private key. This can defeat proof-of-possession, attribution, non-repudiation, or deduplication checks that rely on a signature being bound to the message. Keys produced by normal Ed25519 key generation are not small-order, so applications that verify only trusted or internally generated public keys are not affected. This issue is fixed in version 1.4.3.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a close_notify alert, after the application calls close(), or before handshake() is called. The handler dereferences c.session.md5 before dispatching the message, causing a TypeError to propagate from connection.process(). A malicious server or on-path attacker can deliver the record, including after a reset when the connection uses no encryption, and terminate a Node.js process if the application does not catch the exception. forge.tls servers are not affected, and there is no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take quadratic time. A malicious server or on-path attacker can supply a long whitespace run followed by a non-whitespace character in a response header, causing response.readHeader() or response.getCookies() to repeatedly scan the input and block the Node.js event loop or browser tab for minutes. Applications are affected only when they use forge.http with a socket pool to communicate with an untrusted server; forge.http is not loaded by require('node-forge'), and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState() rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message and terminate a Node.js process when the application does not catch the exception. The affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http; forge.tls servers are not affected, and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
CVE-2026-119191 is a vulnerability in the digitalbazaar forge library (also known as node-forge) prior to version 1.4.1. The flaw involves uncontrolled resource consumption during ASN.1 decoding of nested BIT STRING values, which can lead to excessive recursion, high CPU usage, and quadratic memory consumption. This issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows improper enforcement of the basicConstraints.pathLenConstraint in X.509 CA certificates when the keyUsage extension is missing. This flaw could enable an attacker with access to a path-length-constrained CA's private key or a subordinate CA certificate to create a certificate chain that exceeds the declared path length yet still passes verification. The issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows a remote peer to trigger an uncaught TypeError during TLS handshake processing. This occurs when a TLS record of another content type interrupts a fragmented handshake message, causing the process to fail and potentially disrupting the connection or hosting process. The issue is fixed in version 1.4.1.
CVE-2026-119187 is a high-severity vulnerability in the digitalbazaar forge JavaScript library, specifically in versions prior to 1.4.1. The issue involves uncontrolled recursion during TLS record processing, where the library recursively processes each TLS record, consuming one JavaScript stack frame per record. An attacker could exploit this by sending thousands of small TLS records in a single input chunk, causing a stack overflow and resulting in an uncaught exception that leads to denial of service. This vulnerability is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar forge versions prior to 1.4.1 allows bypassing password-based integrity checks in PKCS#12 processing due to acceptance of zero or negative iteration counts. This leads to predictable encryption keys and IVs in certain password-based encryption schemes, compromising integrity verification. The issue is fixed in version 1.4.1.
An infinite loop vulnerability (CWE-835) exists in digitalbazaar's forge library versions prior to 1.4.1. The issue occurs in the BigInteger.prototype.modInverse() function when it receives a negative value or modulus, causing the Node.js event loop to block at full CPU. This can be triggered if an attacker controls the RSA public exponent passed to key generation or directly controls the modInverse() operand. Commonly parsed cryptographic formats like DER, PEM, JWK, PKCS#12, X.509, and TLS are not affected as they use unsigned values. The vulnerability is fixed in version 1.4.1.
CVE-2026-118780 is a vulnerability in the node-forge library (also known as Forge), a JavaScript implementation of Transport Layer Security. Versions prior to 1.4.1 improperly handle certificate chain verification when certificates share the same subject name. This flaw can cause the CA store to be modified incorrectly, removing trusted CA certificates permanently and resulting in persistent availability issues for applications reusing the store. The issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
CVE-2026-118778 is a vulnerability in the digitalbazaar forge library (node-forge) prior to version 1.4.1. The TLS client implementation incorrectly checked the wrong property when determining if a server certificate was missing during an RSA key exchange. A malicious TLS server or man-in-the-middle could omit the Certificate message, causing a null pointer dereference that leads to an uncaught exception and termination of the connection or process. This issue is fixed in version 1.4.1.
A prototype pollution vulnerability exists in digitalbazaar forge versions prior to 1.4.1. The forge.http client improperly stores cookie names and paths from Set-Cookie headers in plain JavaScript objects, allowing a malicious server to manipulate Object.prototype by using special cookie names such as __proto__ or constructor. This can lead to modification or deletion of inherited properties on Object.prototype. The issue affects applications using forge.http or forge.xhr and is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge library (prior to version 1.4.1) involves improper input validation of PKCS#7 padding during CBC and ECB mode decryption. The library only validated the final padding byte and accepted zero, oversized, or mismatched padding bytes, which could allow malformed ciphertext to be accepted and cause silent removal of up to four plaintext blocks. This leads to an integrity failure in applications that rely on successful decryption as proof of valid padding. The issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 involves improper verification of cryptographic signatures. The implementation incorrectly used the issuer certificate's RSA padding and RSASSA-PSS parameters instead of those from the child certificate being verified. This could allow acceptance of a signature scheme mismatch, bypassing policies that require a declared signature scheme. The issue does not allow certificate identity forgery since the signature must still be produced with the trusted issuer's private key. The vulnerability is fixed in version 1.4.1.