# node-forge (npm) vulnerabilities 24 known vulnerabilities (1 critical, 14 high, 6 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.4.3 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 1.4.3 (Nov 4, 2026), the latest release - Weekly downloads: 53.7M - Dependents: 64.9K - Releases: 137 since 0.1.2 (Jun 19, 2013) - Registry: https://www.npmjs.com/package/node-forge - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-119190: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-119188: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-119187: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-119186: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-118782: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-118781: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-118780: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-118779: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-118778: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-118777: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-118775: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-85393: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-33896: 0.1.2 to 1.3.3 (1.4.0 is outside it) - CVE-2026-33895: 0.1.2 to 1.3.3 (1.4.0 is outside it) - CVE-2026-33894: 0.1.2 to 1.4.0 (1.4.1 is outside it) - CVE-2026-33891: 0.1.2 to 1.3.3 (1.4.0 is outside it) - CVE-2025-66030: 0.1.2 to 1.3.1 (1.3.2 is outside it) - CVE-2025-66031: 0.1.2 to 1.3.1 (1.3.2 is outside it) - CVE-2025-12816: 0.1.2 to 1.3.1 (1.3.2 is outside it) - CVE-2022-24772: 0.1.2 to 1.2.1 (1.3.0 is outside it) - CVE-2022-24773: 0.1.2 to 1.2.1 (1.3.0 is outside it) - CVE-2022-24771: 0.1.2 to 1.2.1 (1.3.0 is outside it) - CVE-2022-0122: 0.1.2 to 0.10.0 (1.0.0 is outside it) - CVE-2020-7720: 0.1.2 to 0.9.2 (0.10.0 is outside it) ## Advisories (24) ### [CVE-2026-119190](https://cve.now/CVE-2026-119190): Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 - Severity: High 7.4 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-119188](https://cve.now/CVE-2026-119188): Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-119187](https://cve.now/CVE-2026-119187): Forge: Denial of service in TLS record processing via call stack exhaustion - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-119186](https://cve.now/CVE-2026-119186): Forge: AES-GCM authentication bypass via unvalidated tagLength option - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-118782](https://cve.now/CVE-2026-118782): Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-118781](https://cve.now/CVE-2026-118781): Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) - Severity: Low 2.9 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-118780](https://cve.now/CVE-2026-118780): Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store - Severity: Low 3.7 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-118779](https://cve.now/CVE-2026-118779): Forge: Regular expression denial of service in PEM decoding (pem.decode) - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-118778](https://cve.now/CVE-2026-118778): Forge: TLS client crash when the server sends no certificate - Severity: Medium 5.9 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-118777](https://cve.now/CVE-2026-118777): Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie - Severity: Medium 4.8 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-118775](https://cve.now/CVE-2026-118775): Forge: ASN.1 OID first arc truncation in asn1.oidToDer - Severity: Low 3.7 - Published: Oct 29, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-85393](https://cve.now/CVE-2026-85393): node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding - Severity: High 8.7 - Published: Sep 3, 2026 - Affected: through 1.4.0; fixed in 1.4.0. - Fixed in 1.4.1 (released Oct 27, 2026, 54 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-33896](https://cve.now/CVE-2026-33896): Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) - Severity: High 7.4 - Published: Mar 27, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 24, 2026, 3 days before disclosure). - The latest release, 1.4.3, is not affected. - 40% of node-forge downloads last week were affected versions (25.5M). ### [CVE-2026-33895](https://cve.now/CVE-2026-33895): Forge has signature forgery in Ed25519 due to missing S \> L check - Severity: High 7.5 - Published: Mar 27, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 24, 2026, 3 days before disclosure). - The latest release, 1.4.3, is not affected. - 40% of node-forge downloads last week were affected versions (25.5M). ### [CVE-2026-33894](https://cve.now/CVE-2026-33894): Forge has signature forgery in RSA-PKCS due to ASN.1 extra field - Severity: High 7.5 - Published: Mar 27, 2026 - Affected: through 1.4.0; fixed in 1.4.0. - Fixed in 1.4.1 (released Oct 27, 2026, 214 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.4.3, is not affected. - 78% of node-forge downloads last week were affected versions (49.7M). ### [CVE-2026-33891](https://cve.now/CVE-2026-33891): Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input - Severity: High 7.5 - Published: Mar 27, 2026 - Affected: fixed in 1.4.0. - Fixed in 1.4.0 (released Mar 24, 2026, 3 days before disclosure). - The latest release, 1.4.3, is not affected. - 40% of node-forge downloads last week were affected versions (25.5M). ### [CVE-2025-66030](https://cve.now/CVE-2025-66030): node-forge ASN.1 OID Integer Truncation - Severity: Medium 6.3 - Published: Nov 26, 2025 - Affected: fixed in 1.3.2. - Fixed in 1.3.2 (released Nov 25, 2025, 1 day before disclosure). - The latest release, 1.4.3, is not affected. - 33% of node-forge downloads last week were affected versions (21.3M). ### [CVE-2025-66031](https://cve.now/CVE-2025-66031): node-forge ASN.1 Unbounded Recursion - Severity: High 8.7 - Published: Nov 26, 2025 - Affected: fixed in 1.3.2. - Fixed in 1.3.2 (released Nov 25, 2025, 1 day before disclosure). - The latest release, 1.4.3, is not affected. - 33% of node-forge downloads last week were affected versions (21.3M). ### [CVE-2025-12816](https://cve.now/CVE-2025-12816): CVE-2025-12816 - Severity: High 8.6 - Published: Nov 25, 2025 - Affected: fixed in 1.3.2. - Fixed in 1.3.2 (released Nov 25, 2025, the day of disclosure). - The latest release, 1.4.3, is not affected. - 33% of node-forge downloads last week were affected versions (21.3M). ### [CVE-2022-24772](https://cve.now/CVE-2022-24772): Improper Verification of Cryptographic Signature in \`node-forge\` - Severity: High 7.5 - Published: Mar 18, 2022 - Affected: fixed in 1.3.0. - Fixed in 1.3.0 (released Mar 17, 2022, 1 day before disclosure). - The latest release, 1.4.3, is not affected. - 9% of node-forge downloads last week were affected versions (5.8M). ### [CVE-2022-24773](https://cve.now/CVE-2022-24773): Improper Verification of Cryptographic Signature in \`node-forge\` - Severity: Medium 5.3 - Published: Mar 18, 2022 - Affected: fixed in 1.3.0. - Fixed in 1.3.0 (released Mar 17, 2022, 1 day before disclosure). - The latest release, 1.4.3, is not affected. - 9% of node-forge downloads last week were affected versions (5.8M). ### [CVE-2022-24771](https://cve.now/CVE-2022-24771): Improper Verification of Cryptographic Signature in node-forge - Severity: High 7.5 - Published: Mar 18, 2022 - Affected: fixed in 1.3.0. - Fixed in 1.3.0 (released Mar 17, 2022, 1 day before disclosure). - The latest release, 1.4.3, is not affected. - 9% of node-forge downloads last week were affected versions (5.8M). ### [CVE-2022-0122](https://cve.now/CVE-2022-0122): Open Redirect in digitalbazaar/forge - Severity: Medium 5.3 - Published: Jan 6, 2022 - Affected: fixed in 1.0.0. - Fixed in 1.0.0 (released Jan 5, 2022, 1 day before disclosure). - The latest release, 1.4.3, is not affected. - 8.8% of node-forge downloads last week were affected versions (5.6M). ### [CVE-2020-7720](https://cve.now/CVE-2020-7720): Prototype Pollution - Severity: Critical 9.8 - Published: Sep 1, 2020 - Affected: fixed in 0.10.0. - Fixed in 0.10.0 (released Sep 2, 2020, 1 day after disclosure). - The latest release, 1.4.3, is not affected. - 3.7% of node-forge downloads last week were affected versions (2.4M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/node-forge Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.