Regular expression denial of service in Forge PEM decoding
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
Forge (node-forge) before 1.4.1 is affected by a regular expression denial of service in its PEM decoding. The pem.decode() function uses polynomial-time regular expressions (CWE-1333), so parsing crafted input consumes excessive CPU. An unauthenticated attacker who can supply PEM input to any high-level parser can send a long malformed message and cause a denial of service.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| digitalbazaar | forge | before 1.4.1 | 1.4.1 | Patch available | CNA |
| — | node-forge (npm) | before 1.4.1 | 1.4.1 | Patch available | GHSA-7wch-p9px-956x |
- forge Vendordigitalbazaar Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA
- node-forge (npm) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-7wch-p9px-956x
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* | — | — | digitalbazaar |
- cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* Versions — — ·digitalbazaar
Remediation
Upgrade digitalbazaar forge and the npm package node-forge to version 1.4.1, the fixed version. Red Hat lists Node HealthCheck Operator, OpenShift Pipelines, OpenShift Serverless, Red Hat AMQ Broker 7 and other products as affected, with the plan listed as none available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA forge (digitalbazaar) Fixed in 1.4.1
- Fix · GHSA-7wch-p9px-956x node-forge (npm) Fixed in 1.4.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
Not affected: 8 products
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat Quay 3
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-29 Threatist record created from CVE-2026-118779
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: MEDIUM → HIGH
- 2026-10-30 Alias added: GHSA-7wch-p9px-956x
- 2026-10-30 Fix available: npm/[email protected] · GHSA-7wch-p9px-956x
- 2026-10-30 CVSS score added · GHSA-7wch-p9px-956x
- 2026-10-30 Weakness changed · GHSA-7wch-p9px-956x
- 2026-10-30 5 new references · GHSA-7wch-p9px-956x
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
More digitalbazaar vulnerabilities
- TI-2026-58601 node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding CVSS 4.0HIGH 8.7
- TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
- TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
- TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
- TI-2026-82733 Forge accepts zero iteration count, enabling PKCS#12 integrity bypass CVSS 3.1HIGH 7.5
- TI-2026-26253 Forge has signature forgery in Ed25519 due to missing S > L check CVSS 3.1HIGH 7.5
Sources
- CVE-2026-118779 · CVE Program
- CVE-2026-118779 · NVD
- FIRST EPSS
- GHSA-7wch-p9px-956x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118779 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences