node-forge has 11 CVEs on record. Disclosure cadence is accelerating: 11 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 11. The median CVSS is 5.9 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.9
- Publish → KEV
- —
- Last 90 days
- 11 prev 0
Weakness classes
Products
- node-forge 11
Worst active — by depth score
CVE-2026-119190High· 7.4Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.1341CVE-2026-119188High· 7.5Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message41CVE-2026-119187High· 7.5Forge: Denial of service in TLS record processing via call stack exhaustion41CVE-2026-118782High· 7.5Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count41CVE-2026-118779High· 7.5Forge: Regular expression denial of service in PEM decoding (pem.decode)41
node-forge vulnerabilities
CVEs affecting node-forge, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-119190High· 7.4Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
CVE-2026-119187High· 7.5Forge: Denial of service in TLS record processing via call stack exhaustion
Forge: Denial of service in TLS record processing via call stack exhaustion
CVE-2026-119188High· 7.5Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
CVE-2026-118782High· 7.5Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
CVE-2026-119186Medium· 5.9Forge: AES-GCM authentication bypass via unvalidated tagLength option
Forge: AES-GCM authentication bypass via unvalidated tagLength option
CVE-2026-118780Low· 3.7Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
CVE-2026-118781Low· 2.9Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
CVE-2026-118779High· 7.5Forge: Regular expression denial of service in PEM decoding (pem.decode)
Forge: Regular expression denial of service in PEM decoding (pem.decode)
CVE-2026-118778Medium· 5.9Forge: TLS client crash when the server sends no certificate
Forge: TLS client crash when the server sends no certificate
CVE-2026-118777Medium· 4.8Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
CVE-2026-118775Low· 3.7Forge: ASN.1 OID first arc truncation in asn1.oidToDer
Forge: ASN.1 OID first arc truncation in asn1.oidToDer