# cve.now: Digitalbazaar

The newest entries naming Digitalbazaar as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125336](https://cve.now/CVE-2026-125336.md): Forge: X.509 nameConstraints not enforced by verifyCertificateChain() (CVSS 7.4)
- [CVE-2026-125335](https://cve.now/CVE-2026-125335.md): Forge: Ed25519 signature verification accepts small-order public keys (CVSS 3.7)
- [CVE-2026-125334](https://cve.now/CVE-2026-125334.md): Forge: TLS client crash on a handshake record received without a session (CVSS 5.9)
- [CVE-2026-125333](https://cve.now/CVE-2026-125333.md): Forge: ReDoS in forge.http response header and cookie trimming (CVSS 5.9)
- [CVE-2026-125332](https://cve.now/CVE-2026-125332.md): Forge: TLS client crash on an unsupported ServerHello compression method (CVSS 5.9)
- [CVE-2026-119191](https://cve.now/CVE-2026-119191.md): Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer (CVSS 7.5)
- [CVE-2026-119190](https://cve.now/CVE-2026-119190.md): Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 (CVSS 7.4)
- [CVE-2026-119189](https://cve.now/CVE-2026-119189.md): Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage (CVSS 5.9)
- [CVE-2026-119188](https://cve.now/CVE-2026-119188.md): Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message (CVSS 7.5)
- [CVE-2026-119187](https://cve.now/CVE-2026-119187.md): Forge: Denial of service in TLS record processing via call stack exhaustion (CVSS 7.5)
- [CVE-2026-119186](https://cve.now/CVE-2026-119186.md): Forge: AES-GCM authentication bypass via unvalidated tagLength option (CVSS 5.9)
- [CVE-2026-118782](https://cve.now/CVE-2026-118782.md): Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count (CVSS 7.5)
- [CVE-2026-118781](https://cve.now/CVE-2026-118781.md): Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) (CVSS 2.9)
- [CVE-2026-118780](https://cve.now/CVE-2026-118780.md): Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store (CVSS 3.7)
- [CVE-2026-118779](https://cve.now/CVE-2026-118779.md): Forge: Regular expression denial of service in PEM decoding (pem.decode) (CVSS 7.5)
- [CVE-2026-118778](https://cve.now/CVE-2026-118778.md): Forge: TLS client crash when the server sends no certificate (CVSS 5.9)
- [CVE-2026-118777](https://cve.now/CVE-2026-118777.md): Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie (CVSS 4.8)
- [CVE-2026-118776](https://cve.now/CVE-2026-118776.md): Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption (CVSS 3.7)
- [CVE-2026-118775](https://cve.now/CVE-2026-118775.md): Forge: ASN.1 OID first arc truncation in asn1.oidToDer (CVSS 3.7)
- [CVE-2026-118774](https://cve.now/CVE-2026-118774.md): Forge: Certificate signature verified with the issuer's RSA signature scheme (CVSS 3.7)
- [CVE-2026-85393](https://cve.now/CVE-2026-85393.md): node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding (CVSS 8.7)
- [CVE-2026-33896](https://cve.now/CVE-2026-33896.md): Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) (CVSS 7.4)
- [CVE-2026-33895](https://cve.now/CVE-2026-33895.md): Forge has signature forgery in Ed25519 due to missing S \> L check (CVSS 7.5)
- [CVE-2026-33894](https://cve.now/CVE-2026-33894.md): Forge has signature forgery in RSA-PKCS due to ASN.1 extra field (CVSS 7.5)
- [CVE-2026-33891](https://cve.now/CVE-2026-33891.md): Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input (CVSS 7.5)
- [CVE-2025-66030](https://cve.now/CVE-2025-66030.md): node-forge ASN.1 OID Integer Truncation (CVSS 6.3)
- [CVE-2025-66031](https://cve.now/CVE-2025-66031.md): node-forge ASN.1 Unbounded Recursion (CVSS 8.7)
- [CVE-2024-31995](https://cve.now/CVE-2024-31995.md): zcap has incomplete expiration checks in capability chains. (CVSS 4.3)
- [CVE-2022-24772](https://cve.now/CVE-2022-24772.md): Improper Verification of Cryptographic Signature in \`node-forge\` (CVSS 7.5)
- [CVE-2022-24773](https://cve.now/CVE-2022-24773.md): Improper Verification of Cryptographic Signature in \`node-forge\` (CVSS 5.3)
- [CVE-2022-24771](https://cve.now/CVE-2022-24771.md): Improper Verification of Cryptographic Signature in node-forge (CVSS 7.5)
- [CVE-2022-0122](https://cve.now/CVE-2022-0122.md): Open Redirect in digitalbazaar/forge (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/digitalbazaar
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.