node-forge vulnerabilities
CVEs whose affected-version data names the node-forge package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
11 CVEsRSS
CVE-2026-119190High· 7.4Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
CVE-2026-119187High· 7.5Forge: Denial of service in TLS record processing via call stack exhaustion
Forge: Denial of service in TLS record processing via call stack exhaustion
CVE-2026-119188High· 7.5Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
CVE-2026-118782High· 7.5Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
CVE-2026-119186Medium· 5.9Forge: AES-GCM authentication bypass via unvalidated tagLength option
Forge: AES-GCM authentication bypass via unvalidated tagLength option
CVE-2026-118780Low· 3.7Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
CVE-2026-118781Low· 2.9Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
CVE-2026-118779High· 7.5Forge: Regular expression denial of service in PEM decoding (pem.decode)
Forge: Regular expression denial of service in PEM decoding (pem.decode)
CVE-2026-118778Medium· 5.9Forge: TLS client crash when the server sends no certificate
Forge: TLS client crash when the server sends no certificate
CVE-2026-118777Medium· 4.8Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
CVE-2026-118775Low· 3.7Forge: ASN.1 OID first arc truncation in asn1.oidToDer
Forge: ASN.1 OID first arc truncation in asn1.oidToDer