Digitalbazaar vulnerabilities
32 CVEs and advisories name Digitalbazaar as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125336Forge: X.509 nameConstraints not enforced by verifyCertificateChain()
- CVE-2026-125335Forge: Ed25519 signature verification accepts small-order public keys
- CVE-2026-125334Forge: TLS client crash on a handshake record received without a session
- CVE-2026-125333Forge: ReDoS in forge.http response header and cookie trimming
- CVE-2026-125332Forge: TLS client crash on an unsupported ServerHello compression method
- CVE-2026-119191Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
- CVE-2026-119190Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
- CVE-2026-119189Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
- CVE-2026-119188Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
- CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustion
- CVE-2026-119186Forge: AES-GCM authentication bypass via unvalidated tagLength option
- CVE-2026-118782Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
- CVE-2026-118781Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
- CVE-2026-118780Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
- CVE-2026-118779Forge: Regular expression denial of service in PEM decoding (pem.decode)
- CVE-2026-118778Forge: TLS client crash when the server sends no certificate
- CVE-2026-118777Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
- CVE-2026-118776Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
- CVE-2026-118775Forge: ASN.1 OID first arc truncation in asn1.oidToDer
- CVE-2026-118774Forge: Certificate signature verified with the issuer's RSA signature scheme
- CVE-2026-85393node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
- CVE-2026-33896Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
- CVE-2026-33895Forge has signature forgery in Ed25519 due to missing S > L check
- CVE-2026-33894Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
- CVE-2026-33891Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
- CVE-2025-66030node-forge ASN.1 OID Integer Truncation
- CVE-2025-66031node-forge ASN.1 Unbounded Recursion
- CVE-2024-31995zcap has incomplete expiration checks in capability chains.
- CVE-2022-24772Improper Verification of Cryptographic Signature in `node-forge`
- CVE-2022-24773Improper Verification of Cryptographic Signature in `node-forge`