{"id":"CVE-2026-118779","kind":"vulnerability","aliases":["CVE-2026-118779"],"related":[],"title":"node-forge: PEM parser regex lets crafted input exhaust CPU","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.","summary":"node-forge, a JavaScript TLS and crypto library, has polynomial-time regular expressions in its PEM decoder. A long malformed PEM message can make the process consume excessive CPU, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["denial-of-service","javascript","node.js","package","tls"],"not_affected_if":["no-untrusted-pem-input","version-1.4.1-or-later"],"how_to_check":"- `npm ls node-forge` to find every installed copy, including transitive dependencies\n- Check the resolved `node-forge` version in your lockfile against `1.4.1`","fix":"- `node-forge` `1.4.1` or later","status":"open","published_at":"2026-10-29T19:17:20+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","triaged_at":"2026-10-29T19:27:25+00:00","updated_at":"2026-10-29T19:27:25+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T19:27:25Z","model":"claude-haiku-5-5","output":{"fix":"- `node-forge` `1.4.1` or later","reach":"network","title":"node-forge: PEM parser regex lets crafted input exhaust CPU","impact":"low","summary":"node-forge, a JavaScript TLS and crypto library, has polynomial-time regular expressions in its PEM decoder. A long malformed PEM message can make the process consume excessive CPU, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","javascript","tls","denial-of-service"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Service becomes unresponsive from CPU exhaustion on crafted PEM input","analyst_note":"","how_to_check":"- `npm ls node-forge` to find every installed copy, including transitive dependencies\n- Check the resolved `node-forge` version in your lockfile against `1.4.1`","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-pem-input","version-1.4.1-or-later"],"who_is_affected":"Applications that pass untrusted PEM input to node-forge's high-level parsers are exposed to CPU exhaustion. Services that only parse PEM data they generate or fully control are unlikely to be reached by an attacker. unknown for any finer detail the sources do not state.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4212,"output_tokens":502,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118779':14A,17A '-2026':13A,16A '1.4.1':79C,154C 'abl':123C 'affect':81C 'also':62C 'attack':122C 'call':63C 'caus':57B,144C 'consum':54B,135C 'could':134C 'cpu':11A,56B,137C 'craft':8A 'crypto':33B 'cve':12A,15A 'decis':96C 'decod':44B 'denial':19B,58B,145C 'denial-of-servic':18B 'encapsul':118C 'end':87C,114C 'excess':55B,136C 'exhaust':10A 'express':40B,105C 'fix':151C 'forg':3A,28B,61C,66C,99C 'header':119C 'high':131C 'high-level':130C 'implement':70C,82C 'includ':108C 'input':9A,93C,127C 'issu':149C 'javascript':22B,30B,76C 'layer':73C 'let':7A 'level':132C 'lib/pem.js':85C 'librari':34B 'line':88C,115C 'long':46B,140C 'make':51B 'malform':47B,141C 'match':113C 'messag':49B,142C 'miss':86C 'nativ':69C 'node':2A,27B,65C,98C 'node-forg':1A,26B,64C,97C 'node.js':23B 'packag':24B 'pars':117C 'parser':5A,133C 'pem':4A,43B,48B,126C 'pem.decode':84C,107C 'polynomi':37B,102C 'polynomial-tim':36B,101C 'prior':77C 'process':53B,90C 'regex':6A 'regular':39B,104C 'relev':92C 'search':110C 'secur':74C,95C 'servic':21B,60B,147C 'suppli':125C 'time':38B,103C 'tls':25B,31B 'transport':72C 'unauthent':121C 'use':83C,100C 'version':153C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted PEM input to node-forge's high-level parsers are exposed to CPU exhaustion. Services that only parse PEM data they generate or fully control are unlikely to be reached by an attacker. unknown for any finer detail the sources do not state.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T19:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118779","severity":null,"published_at":"2026-10-29T19:17:20+00:00","modified_at":"2026-10-29T19:17:20+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","fetched_at":"2026-10-29T19:26:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}