Priority HIGH 72
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
Vulnerabilities
18 records
TI-2026-82735 CVE-2026-119187 · GHSA-hqq3-7jhf-c5jx
Denial of service in Forge TLS record processing via stack exhaustion
Priority HIGH 72
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-82728 CVE-2026-118777 · GHSA-6wvx-3r32-xmcg
Prototype pollution in Forge cookie handling via malicious Set-Cookie
Priority LOW 29
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
Priority MEDIUM 57
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-82722 CVE-2026-118775 · GHSA-4642-5mcj-2rqw
Forge truncates ASN.1 OID first arcs in asn1.oidToDer
Priority MEDIUM 57
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
Priority LOW 23
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-26254 CVE-2026-33896 · GHSA-2328-f5f3-gj25
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Priority HIGH 74
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-26253 CVE-2026-33895 · GHSA-q67f-28xg-22rw
Forge has signature forgery in Ed25519 due to missing S > L check
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-26252 CVE-2026-33894 · GHSA-ppp5-5v6c-4jwp
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-26249 CVE-2026-33891 · GHSA-5m6q-g25r-mvwx
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2025-40556 CVE-2025-66030 · GHSA-65ch-62r8-g69g
node-forge ASN.1 OID Integer Truncation
Priority LOW 34
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2025-40557 CVE-2025-66031 · GHSA-554w-wpv2-vw27
node-forge ASN.1 Unbounded Recursion
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2025-11739 CVE-2025-12816 · GHSA-5gfm-wpxj-wjgq
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and…
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
TI-2022-08586 CVE-2022-24772 · GHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in `node-forge`
Priority MEDIUM 41
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-08587 CVE-2022-24773 · GHSA-2r2c-g63r-vccr
Improper Verification of Cryptographic Signature in `node-forge`
Priority LOW 32
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-08585 CVE-2022-24771 · GHSA-cfm4-qjh2-4765
Improper Verification of Cryptographic Signature in node-forge
Priority MEDIUM 40
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-00067 CVE-2022-0122 · GHSA-8fr3-hfg3-gpgp
Open Redirect in digitalbazaar/forge
Priority LOW 29
forge is vulnerable to URL Redirection to Untrusted Site
TI-2020-06240 CVE-2020-7720 · GHSA-92xj-mqp7-vmcj
Prototype pollution in node-forge
Priority MEDIUM 48
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function.