Vulnerabilities

TI-2026-82739 CVE-2026-119191

ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs

HIGH 72

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00429 Published 2026-10-29 Partial fix · 1.4.1 CWE-400

TI-2026-82738 CVE-2026-119190 · GHSA-5x38-2vff-x55p

Forge certificate chain validation accepts forged CA certificates

HIGH 68

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00246 Published 2026-10-29 Partial fix · 1.4.1 CWE-295

TI-2026-82737 CVE-2026-119189

Forge skips path length check for CA certificates without keyUsage

MEDIUM 60

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00165 Published 2026-10-29 Partial fix · 1.4.1 CWE-295

TI-2026-82736 CVE-2026-119188 · GHSA-8hrf-8g6f-7xwp

Denial of service in Forge TLS handshake processing

LOW 39

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00411 Published 2026-10-29 Partial fix · 1.4.1 CWE-248

TI-2026-82735 CVE-2026-119187 · GHSA-hqq3-7jhf-c5jx

Denial of service in Forge TLS record processing via stack exhaustion

HIGH 72

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00415 Published 2026-10-29 Partial fix · 1.4.1 CWE-674

TI-2026-82734 CVE-2026-119186 · GHSA-5cwg-6vw7-rj6p

Forge AES-GCM decryption accepts unauthenticated data via tagLength

MEDIUM 60

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00206 Published 2026-10-29 Partial fix · 1.4.1 CWE-1284

TI-2026-82733 CVE-2026-118782 · GHSA-jc66-7q78-782g

Forge accepts zero iteration count, enabling PKCS#12 integrity bypass

HIGH 72

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00125 Published 2026-10-29 Partial fix · 1.4.1 CWE-1284

TI-2026-82732 CVE-2026-118781 · GHSA-h6cr-wjv9-3cpp

Infinite loop in Forge modInverse() causes denial of service

LOW 13

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1LOW 2.9 Local No auth No interaction EPSS 0.00119 Published 2026-10-29 Partial fix · 1.4.1 CWE-835

TI-2026-82731 CVE-2026-118780 · GHSA-4487-j8r4-4g2f

Forge chain verification removes trusted CA certificates from store

MEDIUM 51

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00172 Published 2026-10-29 Partial fix · 1.4.1 CWE-295

TI-2026-82730 CVE-2026-118779 · GHSA-7wch-p9px-956x

Regular expression denial of service in Forge PEM decoding

HIGH 72

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00556 Published 2026-10-29 Partial fix · 1.4.1 CWE-1333

TI-2026-82729 CVE-2026-118778 · GHSA-525v-9gp9-w22h

Forge TLS client crashes when server sends no certificate

MEDIUM 60

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00204 Published 2026-10-29 Fixed in 1.4.1 CWE-476

TI-2026-82728 CVE-2026-118777 · GHSA-6wvx-3r32-xmcg

Prototype pollution in Forge cookie handling via malicious Set-Cookie

LOW 29

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00275 Published 2026-10-29 Partial fix · 1.4.1 CWE-1321

TI-2026-82723 CVE-2026-118776

Incomplete PKCS#7 padding validation in Forge decryption

MEDIUM 57

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00136 Published 2026-10-29 Partial fix · 1.4.1 CWE-20

TI-2026-82722 CVE-2026-118775 · GHSA-4642-5mcj-2rqw

Forge truncates ASN.1 OID first arcs in asn1.oidToDer

MEDIUM 57

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00312 Published 2026-10-29 Partial fix · 1.4.1 CWE-190

TI-2026-82721 CVE-2026-118774

Forge checks certificate signatures with the issuer's scheme

LOW 23

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00103 Published 2026-10-29 Partial fix · 1.4.1 CWE-347

TI-2026-58601 CVE-2026-85393 · GHSA-86w9-cpqp-85rv

node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding

HIGH 77

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00248 Published 2026-09-03 Partial fix CWE-347

TI-2026-26254 CVE-2026-33896 · GHSA-2328-f5f3-gj25

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

HIGH 74

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00361 Published 2026-03-27 Partial fix · 1.4.0 CWE-295

TI-2026-26253 CVE-2026-33895 · GHSA-q67f-28xg-22rw

Forge has signature forgery in Ed25519 due to missing S > L check

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00527 Published 2026-03-27 Partial fix · 1.4.0 CWE-347

TI-2026-26252 CVE-2026-33894 · GHSA-ppp5-5v6c-4jwp

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00481 Published 2026-03-27 Partial fix · 1.4.0 CWE-20

TI-2026-26249 CVE-2026-33891 · GHSA-5m6q-g25r-mvwx

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

HIGH 72

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00607 Published 2026-03-27 Partial fix · 1.4.0 CWE-835

TI-2025-40556 CVE-2025-66030 · GHSA-65ch-62r8-g69g

node-forge ASN.1 OID Integer Truncation

LOW 34

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0033 Published 2025-11-26 Partial fix · 1.3.2 CWE-190

TI-2025-40557 CVE-2025-66031 · GHSA-554w-wpv2-vw27

node-forge ASN.1 Unbounded Recursion

MEDIUM 44

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00446 Published 2025-11-26 Partial fix · 1.3.2 CWE-674

TI-2025-11739 CVE-2025-12816 · GHSA-5gfm-wpxj-wjgq

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and…

MEDIUM 44

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0058 Published 2025-11-25 Partial fix · 1.3.2 CWE-436

TI-2024-21094 CVE-2024-31995 · GHSA-hp8h-7x69-4wmv

zcap has incomplete expiration checks in capability chains.

LOW 20

`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00441 Published 2024-04-10 Fixed in 9.0.1 CWE-613

TI-2022-08586 CVE-2022-24772 · GHSA-x4jg-mjrx-434g

Improper Verification of Cryptographic Signature in `node-forge`

MEDIUM 41

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01112 Published 2022-03-18 Partial fix · 1.3.0 CWE-347

Vulnerabilities

Filters