CVE-2026-118776Low· 3.7▾ TwilightPoC availableForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 20.4 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
1 GitHub repo (last check)
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1.
forge < 1.4.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33894High· 7.5Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
CVE-2026-119191High· 7.5Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
CVE-2026-119189Medium· 5.9Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
CVE-2026-118774Low· 3.7Forge: Certificate signature verified with the issuer's RSA signature scheme
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
CVE-2026-33896High· 7.4Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript