Live › vulnerability › CVE-2026-118775
Forge is a JavaScript TLS and crypto library. Before 1.4.1, asn1.oidToDer() did not range-check the first two OID arcs, so an application that checked an untrusted OID string and then encoded it could produce DER for a different, trusted OID.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Only applications that take an OID string from untrusted input, check or authorize it, and then encode it with asn1.oidToDer() are exposed, since the check happens on a different value than the one emitted. DER parsing is not affected. Projects that only parse certificates or do not call oidToDer() on external input can skip it.
No product ranges from the sources yet.
npm ls node-forge.asn1.oidToDer( and see whether the OID string comes from untrusted input before it is checked.1.4.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118775")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.