Live › vulnerability › CVE-2026-118779
node-forge, a JavaScript TLS and crypto library, has polynomial-time regular expressions in its PEM decoder. A long malformed PEM message can make the process consume excessive CPU, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications that pass untrusted PEM input to node-forge's high-level parsers are exposed to CPU exhaustion. Services that only parse PEM data they generate or fully control are unlikely to be reached by an attacker. unknown for any finer detail the sources do not state.
No product ranges from the sources yet.
npm ls node-forge to find every installed copy, including transitive dependenciesnode-forge version in your lockfile against 1.4.1node-forge 1.4.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118779")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.