Priority HIGH 74
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00361 · Published 2026-03-27 · Partial fix · 1.4.0 CWE-295
Priority HIGH 72
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00429 · Published 2026-10-29 · Partial fix · 1.4.1 CWE-400
Priority HIGH 72
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00415 · Published 2026-10-29 · Partial fix · 1.4.1 CWE-674
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00527 · Published 2026-03-27 · Partial fix · 1.4.0 CWE-347
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00481 · Published 2026-03-27 · Partial fix · 1.4.0 CWE-20
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00607 · Published 2026-03-27 · Partial fix · 1.4.0 CWE-835
Priority MEDIUM 57
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00136 · Published 2026-10-29 · Partial fix · 1.4.1 CWE-20
Priority MEDIUM 57
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00312 · Published 2026-10-29 · Partial fix · 1.4.1 CWE-190
Priority MEDIUM 48
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03188 · Published 2020-09-01 · Fixed in 0.10.0 CWE-1321
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority MEDIUM 41
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01112 · Published 2022-03-18 · Partial fix · 1.3.0 CWE-347
Priority MEDIUM 40
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00779 · Published 2022-03-18 · Partial fix · 1.3.0 CWE-347
Priority LOW 34
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0033 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-190
Priority LOW 32
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00956 · Published 2022-03-18 · Partial fix · 1.3.0 CWE-347
Priority LOW 29
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00275 · Published 2026-10-29 · Partial fix · 1.4.1 CWE-1321
Priority LOW 29
forge is vulnerable to URL Redirection to Untrusted Site
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00867 · Published 2022-01-06 · Fixed in 1.0.0 CWE-601
Priority LOW 23
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00103 · Published 2026-10-29 · Partial fix · 1.4.1 CWE-347
THREATIST.IORead the docs