digitalbazaar

Records29All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

digitalbazaar records in CISA KEV

No digitalbazaar vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Forge 18 records HIGH

Records

29 records

TI-2026-58601 CVE-2026-85393 · GHSA-86w9-cpqp-85rv

node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding

HIGH 77

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00248 Published 2026-09-03 Partial fix CWE-347

TI-2026-26254 CVE-2026-33896 · GHSA-2328-f5f3-gj25

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

HIGH 74

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00361 Published 2026-03-27 Partial fix · 1.4.0 CWE-295

TI-2026-82739 CVE-2026-119191

ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs

HIGH 72

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00429 Published 2026-10-29 Partial fix · 1.4.1 CWE-400

TI-2026-82735 CVE-2026-119187 · GHSA-hqq3-7jhf-c5jx

Denial of service in Forge TLS record processing via stack exhaustion

HIGH 72

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00415 Published 2026-10-29 Partial fix · 1.4.1 CWE-674

TI-2026-82733 CVE-2026-118782 · GHSA-jc66-7q78-782g

Forge accepts zero iteration count, enabling PKCS#12 integrity bypass

HIGH 72

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00125 Published 2026-10-29 Partial fix · 1.4.1 CWE-1284

TI-2026-82730 CVE-2026-118779 · GHSA-7wch-p9px-956x

Regular expression denial of service in Forge PEM decoding

HIGH 72

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00556 Published 2026-10-29 Partial fix · 1.4.1 CWE-1333

TI-2026-26253 CVE-2026-33895 · GHSA-q67f-28xg-22rw

Forge has signature forgery in Ed25519 due to missing S > L check

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00527 Published 2026-03-27 Partial fix · 1.4.0 CWE-347

TI-2026-26252 CVE-2026-33894 · GHSA-ppp5-5v6c-4jwp

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00481 Published 2026-03-27 Partial fix · 1.4.0 CWE-20

TI-2026-26249 CVE-2026-33891 · GHSA-5m6q-g25r-mvwx

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00607 Published 2026-03-27 Partial fix · 1.4.0 CWE-835

TI-2026-82738 CVE-2026-119190 · GHSA-5x38-2vff-x55p

Forge certificate chain validation accepts forged CA certificates

HIGH 68

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00246 Published 2026-10-29 Partial fix · 1.4.1 CWE-295

TI-2026-82737 CVE-2026-119189

Forge skips path length check for CA certificates without keyUsage

MEDIUM 60

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00165 Published 2026-10-29 Partial fix · 1.4.1 CWE-295

TI-2026-82734 CVE-2026-119186 · GHSA-5cwg-6vw7-rj6p

Forge AES-GCM decryption accepts unauthenticated data via tagLength

MEDIUM 60

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00206 Published 2026-10-29 Partial fix · 1.4.1 CWE-1284

TI-2026-82729 CVE-2026-118778 · GHSA-525v-9gp9-w22h

Forge TLS client crashes when server sends no certificate

MEDIUM 60

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00204 Published 2026-10-29 Fixed in 1.4.1 CWE-476

TI-2026-82723 CVE-2026-118776

Incomplete PKCS#7 padding validation in Forge decryption

MEDIUM 57

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00136 Published 2026-10-29 Partial fix · 1.4.1 CWE-20

TI-2026-82722 CVE-2026-118775 · GHSA-4642-5mcj-2rqw

Forge truncates ASN.1 OID first arcs in asn1.oidToDer

MEDIUM 57

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00312 Published 2026-10-29 Partial fix · 1.4.1 CWE-190

TI-2026-82731 CVE-2026-118780 · GHSA-4487-j8r4-4g2f

Forge chain verification removes trusted CA certificates from store

MEDIUM 51

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00172 Published 2026-10-29 Partial fix · 1.4.1 CWE-295

TI-2020-06240 CVE-2020-7720 · GHSA-92xj-mqp7-vmcj

Prototype pollution in node-forge

MEDIUM 48

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03188 Published 2020-09-01 Fixed in 0.10.0 CWE-1321

TI-2025-40557 CVE-2025-66031 · GHSA-554w-wpv2-vw27

node-forge ASN.1 Unbounded Recursion

MEDIUM 44

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00446 Published 2025-11-26 Partial fix · 1.3.2 CWE-674

TI-2025-11739 CVE-2025-12816 · GHSA-5gfm-wpxj-wjgq

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and…

MEDIUM 44

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0058 Published 2025-11-25 Partial fix · 1.3.2 CWE-436

TI-2022-08586 CVE-2022-24772 · GHSA-x4jg-mjrx-434g

Improper Verification of Cryptographic Signature in `node-forge`

MEDIUM 41

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01112 Published 2022-03-18 Partial fix · 1.3.0 CWE-347

TI-2022-08585 CVE-2022-24771 · GHSA-cfm4-qjh2-4765

Improper Verification of Cryptographic Signature in node-forge

MEDIUM 40

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00779 Published 2022-03-18 Partial fix · 1.3.0 CWE-347

TI-2026-82736 CVE-2026-119188 · GHSA-8hrf-8g6f-7xwp

Denial of service in Forge TLS handshake processing

LOW 39

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00411 Published 2026-10-29 Partial fix · 1.4.1 CWE-248

TI-2025-40556 CVE-2025-66030 · GHSA-65ch-62r8-g69g

node-forge ASN.1 OID Integer Truncation

LOW 34

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0033 Published 2025-11-26 Partial fix · 1.3.2 CWE-190

TI-2022-08587 CVE-2022-24773 · GHSA-2r2c-g63r-vccr

Improper Verification of Cryptographic Signature in `node-forge`

LOW 32

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00956 Published 2022-03-18 Partial fix · 1.3.0 CWE-347

TI-2026-82728 CVE-2026-118777 · GHSA-6wvx-3r32-xmcg

Prototype pollution in Forge cookie handling via malicious Set-Cookie

LOW 29

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00275 Published 2026-10-29 Partial fix · 1.4.1 CWE-1321

Open these records in search →

Critical	2
High	14
Medium	11
Low	2
No CVSS	0