{"id":"CVE-2026-119191","kind":"vulnerability","aliases":["CVE-2026-119191"],"related":[],"title":"node-forge: nested BIT STRING DER input exhausts CPU and memory","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.","summary":"Forge (node-forge) is a JavaScript TLS and crypto library. Crafted DER input with nested BIT STRINGs makes asn1.fromDer() recurse excessively, using lots of CPU and quadratic memory, which can crash or stall the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node.js","npm","package","tls"],"not_affected_if":["no-untrusted-der-input","node-forge-not-installed"],"how_to_check":"- `npm ls node-forge` to find every installed copy and its version, including nested dependencies\n- Check whether your code calls `asn1.fromDer()` on untrusted input such as certificates or keys from remote peers","fix":"- node-forge: move to `1.4.1` or later","status":"open","published_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","triaged_at":"2026-10-29T20:28:05+00:00","updated_at":"2026-10-29T20:28:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T20:28:05Z","model":"claude-haiku-5-5","output":{"fix":"- node-forge: move to `1.4.1` or later","reach":"network","title":"node-forge: nested BIT STRING DER input exhausts CPU and memory","impact":"medium","summary":"Forge (node-forge) is a JavaScript TLS and crypto library. Crafted DER input with nested BIT STRINGs makes asn1.fromDer() recurse excessively, using lots of CPU and quadratic memory, which can crash or stall the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","javascript","tls","npm"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Denial of service through CPU exhaustion and memory growth in the process","analyst_note":"","how_to_check":"- `npm ls node-forge` to find every installed copy and its version, including nested dependencies\n- Check whether your code calls `asn1.fromDer()` on untrusted input such as certificates or keys from remote peers","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-der-input","node-forge-not-installed"],"who_is_affected":"Applications that parse attacker-supplied DER data with node-forge, for example certificate or key parsing of untrusted input in a server or client. Projects that do not use node-forge or only parse trusted local data are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4232,"output_tokens":506,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119191':15A,18A '-2026':14A,17A '1.4.1':78C,145C 'affect':80C 'also':61C 'appli':108C 'asn.1':100C 'asn1.fromder':43B,83C,138C 'bit':5A,40B,84C,103C,125C 'call':62C 'caus':128C 'configur':110C 'consist':107C 'consumpt':136C 'contain':123C 'copi':116C 'could':127C 'cpu':10A,49B,131C 'craft':35B,121C 'crash':55B 'crypto':33B 'cve':13A,16A 'decis':95C 'decod':86C,99C 'der':7A,36B,122C 'excess':45B,129C 'exhaust':9A 'fix':142C 'forg':3A,24B,27B,60C,65C,98C 'implement':69C,81C 'input':8A,37B,92C 'insid':102C 'issu':140C 'javascript':19B,30B,75C 'layer':72C 'level':120C 'librari':34B 'limit':112C 'lot':47B 'make':42B 'maxdepth':87C,111C 'memori':12A,52B,135C 'nativ':68C 'nest':4A,39B,119C,124C 'node':2A,26B,64C,97C 'node-forg':1A,25B,63C,96C 'node.js':20B 'npm':21B 'packag':22B 'prior':76C 'process':59B,89C 'quadrat':51B,134C 'recurs':44B,114C,130C 'relev':91C 'retain':115C 'secur':73C,94C 'stall':57B 'store':101C 'string':6A,41B,85C,104C,126C 'tls':23B,31B 'transport':71C 'use':46B,82C,132C 'valu':105C 'version':144C 'without':106C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse attacker-supplied DER data with node-forge, for example certificate or key parsing of untrusted input in a server or client. Projects that do not use node-forge or only parse trusted local data are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T20:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119191","severity":null,"published_at":"2026-10-29T20:17:30+00:00","modified_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","fetched_at":"2026-10-29T20:26:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}