{"id":"CVE-2026-118782","kind":"vulnerability","aliases":["CVE-2026-118782"],"related":[],"title":"node-forge: zero iteration count lets crafted PKCS#12 bypass password integrity checks","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.","summary":"Versions of node-forge before 1.4.1 accept a PKCS#12 iteration count of zero or less, so the derived key ignores the password and salt. Crafted PKCS#12 or PKCS#8 encrypted key input can then bypass integrity checks or be decrypted with predictable keys.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node-forge","node.js","package"],"not_affected_if":["no-forge-pkcs12-parsing","no-untrusted-pkcs12","pbes2-only"],"how_to_check":"- Check the installed node-forge version with `npm ls node-forge`\n- Search lockfiles for `node-forge` at versions below `1.4.1`\n- Look for code calling `forge.pkcs12.pkcs12FromAsn1` or `forge.pki.decryptPrivateKeyInfo` on untrusted input","fix":"- node-forge: move to `1.4.1` or later","status":"open","published_at":"2026-10-29T19:17:20+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","triaged_at":"2026-10-29T19:27:25+00:00","updated_at":"2026-10-29T19:27:25+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T19:27:25Z","model":"claude-haiku-5-5","output":{"fix":"- node-forge: move to `1.4.1` or later","reach":"unknown","title":"node-forge: zero iteration count lets crafted PKCS#12 bypass password integrity checks","impact":"medium","summary":"Versions of node-forge before 1.4.1 accept a PKCS#12 iteration count of zero or less, so the derived key ignores the password and salt. Crafted PKCS#12 or PKCS#8 encrypted key input can then bypass integrity checks or be decrypted with predictable keys.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","javascript","node-forge"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker bypasses password checks on crafted PKCS#12 input","analyst_note":"","how_to_check":"- Check the installed node-forge version with `npm ls node-forge`\n- Search lockfiles for `node-forge` at versions below `1.4.1`\n- Look for code calling `forge.pkcs12.pkcs12FromAsn1` or `forge.pki.decryptPrivateKeyInfo` on untrusted input","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-pkcs12","pbes2-only","no-forge-pkcs12-parsing"],"who_is_affected":"Applications that use node-forge to parse PKCS#12 files or encrypted PKCS#8 private keys that come from outside the application are exposed. Apps that only generate keys, or that handle only PBES2/PBKDF2-encrypted content, are not affected by the predictable-key part. Teams that never feed untrusted PKCS#12 or encrypted key material into node-forge can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4373,"output_tokens":633,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118782':17A,20A '-2026':16A,19A '1.4.1':33B,91C,187C '12':10A,37B,55B,98C,102C,129C,149C '8':58B,168C 'accept':34B,95C 'affect':147C 'allow':126C 'also':74C,146C 'bag':163C 'base':105C,138C 'bypass':11A,64B,135C 'call':75C 'cbc':155C,159C 'check':14A,66B,140C 'constant':118C 'content':178C 'count':6A,39B,108C 'craft':8A,53B,127C 'cve':15A,18A 'decrypt':69B 'deriv':46B 'encrypt':59B,106C,142C,164C,169C 'fix':184C 'forg':3A,24B,31B,73C,78C,94C 'forge.pkcs12.pkcs12fromasn1':133C 'forge.pki.decryptprivatekeyinfo':176C 'generatepkcs12key':114C 'ignor':48B 'implement':82C 'includ':160C 'independ':120C,174C 'input':61B,130C,172C 'integr':13A,65B,139C 'issu':182C 'iter':5A,38B,107C 'iv':145C 'javascript':21B,88C 'key':47B,60B,72B,119C,143C,162C,171C 'keytripled':154C 'layer':85C 'less':43B,112C 'let':7A 'mac':99C 'nativ':81C 'node':2A,23B,30B,77C,93C 'node-forg':1A,22B,29B,76C,92C 'node.js':25B 'packag':26B 'password':12A,50B,104C,123C,137C 'password-bas':103C,136C 'pbe':150C 'pbes2/pbkdf2-encrypted':177C 'pbewithshaand3':153C 'pbewithshaand3-keytripledes-cbc':152C 'pbewithshaand40bitrc2':158C 'pbewithshaand40bitrc2-cbc':157C 'pkcs':9A,36B,54B,57B,97C,101C,128C,148C,167C 'pki.pbe':113C 'predict':71B,141C 'prior':89C 'privat':170C 'process':131C,173C 'return':116C 'safecont':165C 'salt':52B,125C 'secur':86C 'shroud':161C 'transport':84C 'unaffect':180C 'use':151C 'version':27B,186C 'zero':4A,41B,110C","nicknames":[],"mitigations":[],"who_affected":"Applications that use node-forge to parse PKCS#12 files or encrypted PKCS#8 private keys that come from outside the application are exposed. Apps that only generate keys, or that handle only PBES2/PBKDF2-encrypted content, are not affected by the predictable-key part. Teams that never feed untrusted PKCS#12 or encrypted key material into node-forge can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T19:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118782","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118782","severity":null,"published_at":"2026-10-29T19:17:20+00:00","modified_at":"2026-10-29T19:17:20+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","fetched_at":"2026-10-29T19:26:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}