---
id: "CVE-2026-118775"
kind: "vulnerability"
aliases: ["CVE-2026-118775"]
title: "node-forge: OID encoding can emit a different trusted OID"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["javascript", "node-forge", "nodejs", "package"]
not_affected_if: ["der-parsing-only", "no-untrusted-oid-input"]
published_at: "2026-10-29T19:17:20+00:00"
first_seen_at: "2026-10-29T19:26:47+00:00"
updated_at: "2026-10-29T19:27:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118775", "first_seen_at": "2026-10-29T19:26:47+00:00"}]
---

# node-forge: OID encoding can emit a different trusted OID

Forge is a JavaScript TLS and crypto library. Before 1.4.1, asn1.oidToDer() did not range-check the first two OID arcs, so an application that checked an untrusted OID string and then encoded it could produce DER for a different, trusted OID.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls node-forge`.
- Search your code for calls to `asn1.oidToDer(` and see whether the OID string comes from untrusted input before it is checked.
- DER parsing is not affected, per the description.

## Fix

- node-forge: `1.4.1`

## Timeline

- 2026-10-29T19:26:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118775

## From the sources

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_