---
id: "CVE-2026-119191"
kind: "vulnerability"
aliases: ["CVE-2026-119191"]
title: "node-forge: nested BIT STRING DER input exhausts CPU and memory"
severity: "high"
cvss: 7.5
epss: 0.00425
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["javascript", "node.js", "npm", "package", "tls"]
not_affected_if: ["no-untrusted-der-input", "node-forge-not-installed"]
published_at: "2026-10-29T20:17:30+00:00"
first_seen_at: "2026-10-29T20:26:50+00:00"
updated_at: "2026-10-30T18:23:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119191", "first_seen_at": "2026-10-29T20:26:50+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-119191", "first_seen_at": "2026-10-30T18:23:39+00:00"}]
---

# node-forge: nested BIT STRING DER input exhausts CPU and memory

Forge (node-forge) is a JavaScript TLS and crypto library. Crafted DER input with nested BIT STRINGs makes asn1.fromDer() recurse excessively, using lots of CPU and quadratic memory, which can crash or stall the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `npm ls node-forge` to find every installed copy and its version, including nested dependencies
- Check whether your code calls `asn1.fromDer()` on untrusted input such as certificates or keys from remote peers

## Fix

- node-forge: move to `1.4.1` or later

## Timeline

- 2026-10-29T20:26:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119191
- 2026-10-30T18:23:39+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-119191

## From the sources

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_