Forge truncates ASN.1 OID first arcs in asn1.oidToDer
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 19 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Forge, also published as the npm package node-forge from 0 before 1.4.1, is affected. The asn1.oidToDer() function does not range-check the first two arcs of an OID (CWE-190). An application that accepts an untrusted OID string, checks it, and then encodes it with asn1.oidToDer() can emit DER for a different, trusted OID, while DER parsing is not affected. A proof-of-concept exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| digitalbazaar | forge | before 1.4.1 | 1.4.1 | Patch available | CNA |
| — | node-forge (npm) | before 1.4.1 | 1.4.1 | Patch available | GHSA-4642-5mcj-2rqw |
- forge Vendordigitalbazaar Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA
- node-forge (npm) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-4642-5mcj-2rqw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* | before 1.4.1 | Vulnerable | digitalbazaar |
- cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·digitalbazaar
Remediation
Update forge and node-forge to 1.4.1. Red Hat plans no fix for Node HealthCheck Operator, OpenShift Service Mesh 3, Red Hat Ceph Storage 4 and Red Hat Fuse 7. Red Hat has no fix available for OpenShift Pipelines, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, Red Hat Connectivity Link 1, Red Hat Developer Hub 1, Red Hat Enterprise Linux 8, 9 and 10, and Red Hat Enterprise Linux AI (RHEL AI) 3.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA forge (digitalbazaar) Fixed in 1.4.1
- Fix · GHSA-4642-5mcj-2rqw node-forge (npm) Fixed in 1.4.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix planned: Out of support scope |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix planned: Out of support scope |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-29 Threatist record created from CVE-2026-118775
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: LOW → MEDIUM
- 2026-10-30 Alias added: GHSA-4642-5mcj-2rqw
- 2026-10-30 Fix available: npm/[email protected] · GHSA-4642-5mcj-2rqw
- 2026-10-30 CVSS score added · GHSA-4642-5mcj-2rqw
- 2026-10-30 Weakness changed · GHSA-4642-5mcj-2rqw
- 2026-10-30 5 new references · GHSA-4642-5mcj-2rqw
- 2026-11-04 CVSS score added · NVD
- 2026-11-07 Affected versions changed · Red Hat
- 2026-11-07 CVSS score added · Red Hat
References
More digitalbazaar Forge vulnerabilities
- TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
- TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
- TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
- TI-2026-26253 Forge has signature forgery in Ed25519 due to missing S > L check CVSS 3.1HIGH 7.5
- TI-2026-26252 Forge has signature forgery in RSA-PKCS due to ASN.1 extra field CVSS 3.1HIGH 7.5
- TI-2026-26249 Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input CVSS 3.1HIGH 7.5
Sources
- CVE-2026-118775 · CVE Program
- CVE-2026-118775 · NVD
- FIRST EPSS
- GHSA-4642-5mcj-2rqw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118775 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences