CVE-2026-119191: digitalbazaar forge

CVSS 7.5 (high) · published 2026-10-29

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.

Affected products (NVD): digitalbazaar forge

Fixed in (NVD): 1.4.1

Weakness: CWE-400, CWE-674

Source: NVD CVE-2026-119191

References

• https://github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4b
• https://github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7
• https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.