Live › vulnerability › CVE-2026-119191
Forge (node-forge) is a JavaScript TLS and crypto library. Crafted DER input with nested BIT STRINGs makes asn1.fromDer() recurse excessively, using lots of CPU and quadratic memory, which can crash or stall the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 20:26 UTC. All times on this page are UTC.
Applications that parse attacker-supplied DER data with node-forge, for example certificate or key parsing of untrusted input in a server or client. Projects that do not use node-forge or only parse trusted local data are less exposed.
No product ranges from the sources yet.
npm ls node-forge to find every installed copy and its version, including nested dependenciesasn1.fromDer() on untrusted input such as certificates or keys from remote peers1.4.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-119191")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.