{"id":"CVE-2026-118776","kind":"vulnerability","aliases":["CVE-2026-118776"],"related":[],"title":"node-forge: weak PKCS#7 padding check lets malformed ciphertext decrypt","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1.","summary":"node-forge accepts malformed PKCS#7 padding in CBC and ECB decryption, validating only the final byte. Malformed ciphertext can be accepted and up to four plaintext blocks silently dropped, breaking integrity in apps that treat successful decryption as proof of valid padding.","severity":"low","cvss":3.7,"epss":0.00131,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node-forge","poc-public","node","javascript","package"],"not_affected_if":["authenticated-encryption-verified","no-cbc-or-ecb-decryption"],"how_to_check":"- Check the installed version with `npm ls node-forge` and look for anything below `1.4.1`\n- Search the project for `forge.cipher` or `decipher.finish()` used with CBC or ECB modes","fix":"- node-forge: move to `1.4.1` or later","status":"open","published_at":"2026-10-29T19:17:20+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","triaged_at":"2026-10-29T19:27:35+00:00","updated_at":"2026-10-30T21:27:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T19:27:35Z","model":"claude-haiku-5-5","output":{"fix":"- node-forge: move to `1.4.1` or later","reach":"unknown","title":"node-forge: weak PKCS#7 padding check lets malformed ciphertext decrypt","impact":"low","summary":"node-forge accepts malformed PKCS#7 padding in CBC and ECB decryption, validating only the final byte. Malformed ciphertext can be accepted and up to four plaintext blocks silently dropped, breaking integrity in apps that treat successful decryption as proof of valid padding.","audience":"developers","category":"package","nicknames":[],"who_cares":["node-forge","javascript","node"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"malformed ciphertext accepted and plaintext blocks silently removed","analyst_note":"","how_to_check":"- Check the installed version with `npm ls node-forge` and look for anything below `1.4.1`\n- Search the project for `forge.cipher` or `decipher.finish()` used with CBC or ECB modes","plain_action":"","needs_analyst":false,"not_affected_if":["no-cbc-or-ecb-decryption","authenticated-encryption-verified"],"who_is_affected":"Applications that use node-forge for CBC or ECB decryption and rely on a successful decrypt call as proof that the padding and data are valid. Projects that do not decrypt with these modes, or that verify integrity separately (such as an authenticated mode or a MAC), are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000697,"input_tokens":4242,"output_tokens":545,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-118776':15A,18A '-2026':14A,17A '1.4.1':90C,173C '7':6A,34B,101C,121C 'accept':31B,50B,129C,141C 'affect':92C 'also':73C 'app':62B 'applic':157C 'block':56B,147C 'break':59B 'byte':45B,118C,135C 'call':74C 'caus':152C 'cbc':37B,96C,124C 'check':8A 'ciphertext':11A,47B,137C 'consequ':139C 'could':138C,148C 'cve':13A,16A 'decipher.finish':95C 'decis':110C 'decrypt':12A,40B,66B,127C,161C 'drop':58B 'ecb':39B,98C,126C 'failur':155C 'final':44B,117C 'fix':170C 'forg':3A,21B,30B,72C,77C,113C 'four':54B,145C 'implement':81C,93C 'input':107C 'integr':60B,154C 'issu':168C 'javascript':26B,87C 'layer':84C 'let':9A 'malform':10A,32B,46B,136C 'mismatch':133C 'mode':99C 'nativ':80C 'node':2A,20B,25B,29B,76C,112C 'node-forg':1A,19B,28B,75C,111C 'overs':131C 'packag':27B 'pad':7A,35B,71B,102C,122C,134C,166C 'pkcs':5A,33B,100C,120C 'plaintext':55B,146C 'poc':23B 'poc-publ':22B 'prior':88C 'process':104C 'proof':68B,163C 'public':24B 'relev':106C 'remov':151C 'secur':85C,109C 'silent':57B,150C 'success':65B,160C 'transport':83C 'treat':64B,159C 'use':94C 'valid':41B,70B,114C,165C 'version':172C 'weak':4A 'zero':130C","nicknames":[],"mitigations":[],"who_affected":"Applications that use node-forge for CBC or ECB decryption and rely on a successful decrypt call as proof that the padding and data are valid. Projects that do not decrypt with these modes, or that verify integrity separately (such as an authenticated mode or a MAC), are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T19:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-118776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118776","severity":null,"published_at":"2026-10-29T19:17:20+00:00","modified_at":"2026-10-29T19:17:20+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","fetched_at":"2026-10-29T19:26:47+00:00","note":null},{"source":"epss","external_id":"CVE-2026-118776","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118776","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T18:23:39+00:00","fetched_at":"2026-10-30T18:23:39+00:00","note":null},{"source":"github-poc","external_id":"zebbernCVE/CVE-2026-118776","url":"https://github.com/zebbernCVE/CVE-2026-118776","severity":null,"published_at":"2026-10-30T21:26:07+00:00","modified_at":null,"first_seen_at":"2026-10-30T21:27:09+00:00","fetched_at":"2026-10-30T21:27:09+00:00","note":null}],"documents":[{"id":26089,"url":"https://github.com/zebbernCVE/CVE-2026-118776","title":"zebbernCVE/CVE-2026-118776","kind":"poc","source":"github","publisher":null,"text":"Advisory for node-forge ⌯⌲ 53 mill weekly downloads\n\nstars 0","published_at":"2026-10-30T21:26:07+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}