CVE-2026-119191 reported in node-forge before 1.4.1 in DER parsing
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Forge
- Product
- Forge (node-forge)
- First seen
Summary
A CVE listing rated High (7.5) describes node-forge versions before 1.4.1, where the implementation uses asn1.fromDer() with BIT STRING decoding and maxDepth to process input or security decisions. The item is truncated and does not fully state the impact, so the exact consequence is not confirmed here.
If you use Forge
Upgrade node-forge to version 1.4.1 or later
Run npm ls node-forge to find direct and transitive dependencies
Avoid parsing untrusted DER input with affected versions until patched
Run npm ls node-forge to find affected installs
Upgrade node-forge to 1.4.1 or later
Review the full CVE-2026-119188 advisory for impact details
What the sources say 2
· Mastodon: “Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision....” Source
· Mastodon: “Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the rel...” Source