---
id: "CVE-2026-118776"
kind: "vulnerability"
aliases: ["CVE-2026-118776"]
title: "node-forge: weak PKCS#7 padding check lets malformed ciphertext decrypt"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["javascript", "node", "node-forge", "package"]
not_affected_if: ["authenticated-encryption-verified", "no-cbc-or-ecb-decryption"]
published_at: "2026-10-29T19:17:20+00:00"
first_seen_at: "2026-10-29T19:26:47+00:00"
updated_at: "2026-10-29T19:27:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118776", "first_seen_at": "2026-10-29T19:26:47+00:00"}]
---

# node-forge: weak PKCS#7 padding check lets malformed ciphertext decrypt

node-forge accepts malformed PKCS#7 padding in CBC and ECB decryption, validating only the final byte. Malformed ciphertext can be accepted and up to four plaintext blocks silently dropped, breaking integrity in apps that treat successful decryption as proof of valid padding.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls node-forge` and look for anything below `1.4.1`
- Search the project for `forge.cipher` or `decipher.finish()` used with CBC or ECB modes

## Fix

- node-forge: move to `1.4.1` or later

## Timeline

- 2026-10-29T19:26:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118776

## From the sources

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_