Skip to main content
cve.nowby Sazabi
← npm
npmPackage

node-forge

24 known vulnerabilities (1 critical, 14 high, 6 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
1.4.3 (Nov 4, 2026): no advisory affects it
Newest unaffected release
1.4.3 (Nov 4, 2026), the latest release
Advisories
24 · 1 critical, 14 high, 6 medium, 3 low
Weekly downloads
53.7M
Dependents
64.9K
Releases
137 since 0.1.2 (Jun 19, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 24 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 24

  • Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • Forge: Denial of service in TLS record processing via call stack exhaustion

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • CVE-2026-119186Medium 5.9

    Forge: AES-GCM authentication bypass via unvalidated tagLength option

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • Forge: Regular expression denial of service in PEM decoding (pem.decode)

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • CVE-2026-118778Medium 5.9

    Forge: TLS client crash when the server sends no certificate

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • CVE-2026-118777Medium 4.8

    Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • Forge: ASN.1 OID first arc truncation in asn1.oidToDer

    Affected: fixed in 1.4.1.

    Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding

    Affected: through 1.4.0; fixed in 1.4.0.

    Fixed in 1.4.1 (released Oct 27, 2026, 54 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

  • Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 24, 2026, 3 days before disclosure).

    The latest release, 1.4.3, is not affected.

    40% of node-forge downloads last week were affected versions (25.5M).

  • Forge has signature forgery in Ed25519 due to missing S > L check

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 24, 2026, 3 days before disclosure).

    The latest release, 1.4.3, is not affected.

    40% of node-forge downloads last week were affected versions (25.5M).

  • Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

    Affected: through 1.4.0; fixed in 1.4.0.

    Fixed in 1.4.1 (released Oct 27, 2026, 214 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.4.3, is not affected.

    78% of node-forge downloads last week were affected versions (49.7M).

Show all 24 advisoriesShow fewer advisories

  • Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

    Affected: fixed in 1.4.0.

    Fixed in 1.4.0 (released Mar 24, 2026, 3 days before disclosure).

    The latest release, 1.4.3, is not affected.

    40% of node-forge downloads last week were affected versions (25.5M).

  • CVE-2025-66030Medium 6.3

    node-forge ASN.1 OID Integer Truncation

    Affected: fixed in 1.3.2.

    Fixed in 1.3.2 (released Nov 25, 2025, 1 day before disclosure).

    The latest release, 1.4.3, is not affected.

    33% of node-forge downloads last week were affected versions (21.3M).

  • node-forge ASN.1 Unbounded Recursion

    Affected: fixed in 1.3.2.

    Fixed in 1.3.2 (released Nov 25, 2025, 1 day before disclosure).

    The latest release, 1.4.3, is not affected.

    33% of node-forge downloads last week were affected versions (21.3M).

  • CVE-2025-12816

    Affected: fixed in 1.3.2.

    Fixed in 1.3.2 (released Nov 25, 2025, the day of disclosure).

    The latest release, 1.4.3, is not affected.

    33% of node-forge downloads last week were affected versions (21.3M).

  • Improper Verification of Cryptographic Signature in `node-forge`

    Affected: fixed in 1.3.0.

    Fixed in 1.3.0 (released Mar 17, 2022, 1 day before disclosure).

    The latest release, 1.4.3, is not affected.

    9% of node-forge downloads last week were affected versions (5.8M).

  • CVE-2022-24773Medium 5.3

    Improper Verification of Cryptographic Signature in `node-forge`

    Affected: fixed in 1.3.0.

    Fixed in 1.3.0 (released Mar 17, 2022, 1 day before disclosure).

    The latest release, 1.4.3, is not affected.

    9% of node-forge downloads last week were affected versions (5.8M).

  • Improper Verification of Cryptographic Signature in node-forge

    Affected: fixed in 1.3.0.

    Fixed in 1.3.0 (released Mar 17, 2022, 1 day before disclosure).

    The latest release, 1.4.3, is not affected.

    9% of node-forge downloads last week were affected versions (5.8M).

  • CVE-2022-0122Medium 5.3

    Open Redirect in digitalbazaar/forge

    Affected: fixed in 1.0.0.

    Fixed in 1.0.0 (released Jan 5, 2022, 1 day before disclosure).

    The latest release, 1.4.3, is not affected.

    8.8% of node-forge downloads last week were affected versions (5.6M).

  • CVE-2020-7720Critical 9.8

    Prototype Pollution

    Affected: fixed in 0.10.0.

    Fixed in 0.10.0 (released Sep 2, 2020, 1 day after disclosure).

    The latest release, 1.4.3, is not affected.

    3.7% of node-forge downloads last week were affected versions (2.4M).