Live › vulnerability › CVE-2026-118780
node-forge, a JavaScript TLS and crypto library, modifies its CA store when certificates share a subject name during chain verification. A failed verification can permanently remove trusted CAs, so later valid chains fail, which breaks availability for apps that reuse the store.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications that use node-forge's pki.verifyCertificateChain() with a CA store created by pki.createCaStore() and reuse that store across verifications are exposed. Code that does not verify certificate chains with node-forge, or that creates a fresh store per check, is unlikely to be affected. Teams that only use node-forge for unrelated crypto can skip it.
No product ranges from the sources yet.
node-forge in package-lock.json, yarn.lock or pnpm-lock.yaml and read the resolved version.pki.createCaStore() and reuses that store across requests.npm ls node-forge to see every copy in the dependency tree.node-forge 1.4.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118780")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.