TI-2026-82731 Aliases CVE-2026-118780 GHSA-4487-j8r4-4g2f

Forge chain verification removes trusted CA certificates from store

MEDIUM 51CWE-295Published 2026-10-29 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 19 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

The forge package before 1.4.1 and the npm package node-forge before 1.4.1 are affected. Improper certificate validation (CWE-295) lets pki.verifyCertificateChain() modify the CA store while it tries certificates with the same subject name. A failed chain verification can permanently remove trusted CA certificates, so later valid chains fail for applications that reuse the store. An unauthenticated remote attacker can trigger this, though the attack is of high complexity.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00172 6th percentileScored 2026-11-07

Fix Partial forge (digitalbazaar): 1.4.1node-forge (npm): 1.4.1Red Hat: 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
digitalbazaar	forge	before 1.4.1	1.4.1	Patch available	CNA
—	node-forge (npm)	before 1.4.1	1.4.1	Patch available	GHSA-4487-j8r4-4g2f

forge Vendordigitalbazaar Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA
node-forge (npm) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-4487-j8r4-4g2f

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:digitalbazaar:forge::::::::	—	—	digitalbazaar

cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* Versions — — ·digitalbazaar

Remediation

Upgrade to forge 1.4.1 or node-forge 1.4.1, which fixes the issue. Red Hat lists these products as affected without a fix: Node HealthCheck Operator, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 3, Red Hat AMQ Broker 7, and other products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Fix · CNA forge (digitalbazaar) Fixed in 1.4.1
Fix · GHSA-4487-j8r4-4g2f node-forge (npm) Fixed in 1.4.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Node HealthCheck Operator	Affected	No fix planned: Out of support scope
OpenShift Pipelines	Affected	No fix yet: Fix deferred
OpenShift Serverless	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 3	Affected	No fix planned: Out of support scope
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Build of Podman Desktop	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 4	Affected	No fix planned: Out of support scope
Red Hat Connectivity Link 1	Affected	No fix yet: Fix deferred
Red Hat Developer Hub 1	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix planned: Out of support scope
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat Quay 3	Affected	No fix planned: Out of support scope
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Self-service automation portal 2	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-29 Threatist record created from CVE-2026-118780
2026-10-30 Alias added: GHSA-4487-j8r4-4g2f
2026-10-30 Fix available: npm/[email protected] · GHSA-4487-j8r4-4g2f
2026-10-30 CVSS score added · GHSA-4487-j8r4-4g2f
2026-10-30 Weakness changed · GHSA-4487-j8r4-4g2f
2026-10-30 5 new references · GHSA-4487-j8r4-4g2f
2026-11-04 CISA SSVC decision points changed
2026-11-04 Priority changed: LOW → MEDIUM
2026-11-07 Affected versions changed · Red Hat
2026-11-07 CVSS score added · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-118780

Other 4

TI-2026-58601 node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding CVSS 4.0HIGH 8.7
TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
TI-2026-82733 Forge accepts zero iteration count, enabling PKCS#12 integrity bypass CVSS 3.1HIGH 7.5
TI-2026-82730 Regular expression denial of service in Forge PEM decoding CVSS 3.1HIGH 7.5

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences