TI-2026-82732 Aliases CVE-2026-118781 GHSA-h6cr-wjv9-3cpp

Infinite loop in Forge modInverse() causes denial of service

LOW 13CWE-835Published 2026-10-29 · Updated 2026-10-30

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 19 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

Forge (node-forge) versions before 1.4.1 are affected. The bundled jsbn implementation enters an infinite loop (CWE-835) when BigInteger.prototype.modInverse() receives a negative value or modulus. An attacker who controls the RSA public exponent passed to key generation, or a direct modInverse() operand, can block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509 and TLS values cannot trigger it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00119 1st percentileScored 2026-11-07

Fix Partial forge (digitalbazaar): 1.4.1node-forge (npm): 1.4.1Red Hat: 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
digitalbazaar	forge	before 1.4.1	1.4.1	Patch available	CNA
—	node-forge (npm)	before 1.4.1	1.4.1	Patch available	GHSA-h6cr-wjv9-3cpp

forge Vendordigitalbazaar Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA
node-forge (npm) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-h6cr-wjv9-3cpp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:digitalbazaar:forge::::::::	—	—	digitalbazaar

cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* Versions — — ·digitalbazaar

Remediation

Upgrade Forge (node-forge) to version 1.4.1. Red Hat lists Node HealthCheck Operator, Red Hat Ceph Storage 4 and Red Hat Fuse 7 as affected with no fix planned, and lists OpenShift Pipelines, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, Red Hat Connectivity Link 1, Red Hat Developer Hub 1, Red Hat Enterprise Linux 8, 9 and 10, and Red Hat Enterprise Linux AI (RHEL AI) 3 as affected with no fix available. The sources list no fixed version for OpenShift Service Mesh 3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Fix · CNA forge (digitalbazaar) Fixed in 1.4.1
Fix · GHSA-h6cr-wjv9-3cpp node-forge (npm) Fixed in 1.4.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Node HealthCheck Operator	Affected	No fix planned: Out of support scope
OpenShift Pipelines	Affected	No fix yet: Fix deferred
OpenShift Serverless	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 3	Affected	No fix planned: Out of support scope
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Build of Podman Desktop	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 4	Affected	No fix planned: Out of support scope
Red Hat Connectivity Link 1	Affected	No fix yet: Fix deferred
Red Hat Developer Hub 1	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix planned: Out of support scope
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat Quay 3	Affected	No fix planned: Out of support scope
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Self-service automation portal 2	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-29 Threatist record created from CVE-2026-118781
2026-10-30 CISA SSVC decision points changed
2026-10-30 Alias added: GHSA-h6cr-wjv9-3cpp
2026-10-30 Fix available: npm/[email protected] · GHSA-h6cr-wjv9-3cpp
2026-10-30 CVSS score added · GHSA-h6cr-wjv9-3cpp
2026-10-30 Weakness changed · GHSA-h6cr-wjv9-3cpp
2026-10-30 5 new references · GHSA-h6cr-wjv9-3cpp
2026-11-07 Affected versions changed · Red Hat
2026-11-07 CVSS score added · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-118781

Other 4

TI-2026-58601 node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding CVSS 4.0HIGH 8.7
TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
TI-2026-82733 Forge accepts zero iteration count, enabling PKCS#12 integrity bypass CVSS 3.1HIGH 7.5
TI-2026-82730 Regular expression denial of service in Forge PEM decoding CVSS 3.1HIGH 7.5

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences