{"id":"CVE-2026-119192","kind":"vulnerability","aliases":["CVE-2026-119192","GHSA-6qrw-m8cv-hcxf"],"related":[],"title":"Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding","description":"### Summary\nRSASSA-PKCS1-v1_5 signature verification (`publicKey.verify()` with the default scheme, also used by X.509 certificate and PKCS#7 verification) accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-minimal lengths. These leave attacker-controlled bytes inside an accepted DigestInfo, which allows signatures to be forged without the private key for RSA keys with a low public exponent (e=3). Fixed in node-forge 1.4.1.\n\n### Details\nIn `lib/rsa.js`, `key.verify()` with the default `RSASSA-PKCS1-V1_5` scheme removes the padding, parses the recovered DigestInfo with the lenient BER parser `asn1.fromDer()` and checks its structure with `asn1.validate()` against `digestInfoValidator`. Neither requires a canonical DER encoding, so verification accepted, among others:\n- NULL parameters with content bytes (e.g. `05 40 <64 bytes>`)\n- non-NULL or constructed values in the parameters position\n- non-minimal (long form) and indefinite lengths\n- non-canonical OID encodings (padded subidentifiers, trailing bytes)\n\nThese leave attacker-controlled bytes inside an accepted DigestInfo. For RSA keys with a low public exponent (e=3) this allows signatures to be forged without the private key (BERserk / Bleichenbacher-style forgery, see CVE-2014-1568).\n\nRFC 8017 section 8.2.2 verifies a signature by encoding the expected EMSA-PKCS1-v1_5 message and comparing it with the recovered one; section 9.2 defines the DigestInfo encoding.\n\nThe fix adds `_encodeDigestInfo()`, which DER-encodes the expected DigestInfo from the digest algorithm OID and the digest (with and without NULL parameters). Verification now requires the recovered DigestInfo to match one of these encodings byte for byte. The same change fixes GHSA-2g46-22mc-6gwp (CVE-2026-85393).\n\n#### Patches\nFixed in node-forge 1.4.1. Verification now re-encodes the expected DigestInfo and requires a byte-for-byte match (RFC 8017 section 8.2.2).\n\n#### Workarounds\nDo not use RSA keys with a low public exponent (e=3) for signature verification.\n\n#### References\n- https://www.rfc-editor.org/rfc/rfc8017#section-8.2.2\n- https://www.rfc-editor.org/rfc/rfc8017#section-9.2\n- CVE-2026-85393 / GHSA-2g46-22mc-6gwp (related, same fix)\n- CVE-2026-33894 / https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp\n- https://www.cve.org/CVERecord?id=CVE-2014-1568 (BERserk)\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5, High)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N (8.2)\nBoth versions rate this High. The severity rating follows CVSS 3.1.\n\n#### Credits\nIndependently reported by Oren Yomtov (@orenyomtov, Fireblocks), Bronson Yen (Calif.io, in collaboration with Claude and Anthropic Research), Kamil Hałajda, @pzartech, @antonlissone and @Brechard.\n\n### Proof of concept\nDigestInfo encodings accepted before 1.4.1 (SHA-256; OID = 06 09 60 86 48 01 65 03 04 02 01, H = the 32-byte digest):\n\n    NULL parameters with content:  30 33 30 0F <OID> 05 02 BE EF 04 20 <H>\n    non-minimal DigestInfo length: 30 81 31 30 0D <OID> 05 00 04 20 <H>\n    (canonical form:               30 31 30 0D <OID> 05 00 04 20 <H>)\n\nLong-form lengths are accepted the same way for the DigestAlgorithm, OID, NULL and digest fields. A signature whose EMSA-PKCS1-v1_5 block (00 01 FF..FF 00 || DigestInfo) contains such an encoding verified as valid: `publicKey.verify(digest, signature)` returned true. Content bytes in the NULL parameters (reports used e.g. `05 40 <64 bytes>`) and similar slack give an attacker room to construct a forged signature for an e=3 key. With 1.4.1, verification throws \"ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 DigestInfo value.\"\n\nRegression tests: tests/unit/rsa.js, \"canonical DigestInfo checks\". They use an e=1 key, so the signature equals the encoded block, with one test per non-canonical shape (also indefinite length, constructed and non-NULL parameters, padded OID subidentifiers) and two tests that the canonical encodings with and without NULL parameters still verify. Included in the 1.4.1 release.\n\n### Impact\nApplications that verify RSASSA-PKCS1-v1_5 signatures with node-forge: `publicKey.verify()` with the default scheme, and X.509 certificate and PKCS#7 signature verification, which use it. If the verifying RSA public key has a low public exponent (e=3), an attacker can forge a signature that verifies as valid, without the private key. Only keys with a small public exponent such as e=3 are practically affected.","summary":"node-forge accepted malformed BER encodings of the DigestInfo during RSASSA-PKCS1-v1_5 signature verification. For RSA keys with public exponent e=3, an attacker can forge a signature that verifies as valid without the private key.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node-forge","fixed":["1.4.1"],"affected":"<= 1.4.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-347","node-forge","node.js","package","pkcs7","rsa","x509"],"not_affected_if":["default-exponent-keys","no-rsa-verify","version-1.4.1-or-later"],"how_to_check":"- Check the installed version with `npm ls node-forge` and confirm it is `1.4.1` or later.\n- Search for RSA verification with low-exponent keys: `publicKey.verify(` and X.509 or PKCS#7 verification calls in code that uses node-forge.\n- Check whether any verifying public key has public exponent e=3.","fix":"- node-forge: move to `1.4.1` or later.","status":"open","published_at":"2026-11-10T15:57:34+00:00","first_seen_at":"2026-11-10T15:58:11+00:00","triaged_at":"2026-11-10T15:58:24+00:00","updated_at":"2026-11-10T15:58:24+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-10T15:58:24Z","model":"claude-haiku-5-5","output":{"fix":"- node-forge: move to `1.4.1` or later.","reach":"network","title":"node-forge: RSA signature forgery through non-canonical DigestInfo encoding","impact":"high","summary":"node-forge accepted malformed BER encodings of the DigestInfo during RSASSA-PKCS1-v1_5 signature verification. For RSA keys with public exponent e=3, an attacker can forge a signature that verifies as valid without the private key.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","node-forge","x509","pkcs7","rsa"],"confidence":0.9,"fix_status":"available","needs_auth":"no","worst_case":"Attacker forges signatures accepted as valid by the verifier.","analyst_note":"","how_to_check":"- Check the installed version with `npm ls node-forge` and confirm it is `1.4.1` or later.\n- Search for RSA verification with low-exponent keys: `publicKey.verify(` and X.509 or PKCS#7 verification calls in code that uses node-forge.\n- Check whether any verifying public key has public exponent e=3.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-exponent-keys","no-rsa-verify","version-1.4.1-or-later"],"who_is_affected":"Applications that use node-forge to verify RSASSA-PKCS1-v1_5 signatures, including via publicKey.verify(), X.509 certificate chains and PKCS#7 signatures. Exposure requires the verifying RSA public key to have a low public exponent such as e=3; keys with larger exponents are not practically affected according to the advisory.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000968,"input_tokens":6572,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119192':16A,24A '-1568':276C '-2014':275C '-2026':15A,23A,356C,409C,420C '-256':507C '-33894':421C '-347':29B '-85393':357C,410C '/av':434C,450C '/cverecord?id=cve-2014-1568':427C '/digitalbazaar/forge/security/advisories/ghsa-ppp5-5v6c-4jwp':424C '/rfc/rfc8017#section-8.2.2':404C '/rfc/rfc8017#section-9.2':407C '00':550C,560C,589C,593C '01':514C,519C,590C '02':518C,534C '03':516C '04':517C,537C,551C,561C '05':207C,533C,549C,559C,616C '06':509C '09':510C '0d':548C,558C '0f':532C '1':4A,665C '1.4.1':155C,364C,505C,638C '20':538C,552C,562C '22mc':353C,414C '2g46':352C,413C '3':63B,149C,257C,397C,635C '3.1':431C,433C,473C '30':529C,531C,544C,547C,555C,557C '31':546C,556C '32':522C '33':530C '4.0':446C,449C '40':208C,617C '48':513C '5':53B,83C,167C,292C,587C,652C '60':511C '64':209C,618C '65':515C '6gwp':354C,415C '6qrw':19A '7':98C '7.5':443C '8.2':462C '8.2.2':280C,384C '8017':278C,382C '81':545C '86':512C '9.2':302C 'accept':41B,100C,128C,198C,246C,503C,568C 'add':309C 'algorithm':321C 'allow':131C,259C 'also':91C,682C 'among':199C 'anthrop':490C 'antonlisson':495C 'asn.1':641C 'asn1.fromder':181C 'asn1.validate':187C 'attack':65B,123C,241C,625C 'attacker-control':122C,240C 'ber':43B,104C,179C 'berserk':268C,428C 'bleichenbach':270C 'bleichenbacher-styl':269C 'block':588C,673C 'brechard':497C 'bronson':482C 'byte':125C,205C,210C,237C,243C,343C,345C,377C,379C,523C,608C,619C 'byte-for-byt':376C 'calif.io':484C 'canon':11A,103C,193C,231C,553C,658C,680C 'certif':95C 'chang':348C 'check':183C,660C 'claud':488C 'collabor':486C 'compar':295C 'concept':500C 'construct':215C,628C,685C 'contain':595C,645C 'content':114C,204C,528C,607C 'control':124C,242C 'credit':474C 'cve':14A,22A,274C,355C,408C,419C 'cvss':430C,432C,445C,448C,472C 'cwe':28B 'default':89C,162C 'defin':303C 'der':194C,313C 'der-encod':312C 'detail':156C 'digest':320C,325C,524C,578C,603C 'digestalgorithm':574C 'digestinfo':12A,47B,108C,129C,175C,247C,305C,317C,336C,372C,501C,542C,594C,653C,659C 'digestinfovalid':189C 'e':62B,148C,256C,396C,634C,664C 'e.g':206C,615C 'ef':536C 'emsa':289C,584C 'emsa-pkcs1-v1':288C,583C 'encod':13A,44B,105C,195C,233C,285C,306C,314C,342C,369C,502C,598C,672C 'encodedigestinfo':310C 'equal':670C 'expect':287C,316C,371C 'expon':61B,147C,255C,395C 'ff':591C,592C 'field':579C 'fireblock':481C 'fix':150C,308C,349C,359C,418C 'follow':471C 'forg':1A,32B,40B,67B,135C,154C,263C,363C,630C 'forge':27A 'forgeri':7A,272C 'form':225C,554C,565C 'ghsa':18A,351C,412C 'ghsa-2g46-22mc-6gwp':350C,411C 'ghsa-6qrw-m8cv-hcxf':17A 'github.com':423C 'github.com/digitalbazaar/forge/security/advisories/ghsa-ppp5-5v6c-4jwp':422C 'give':623C 'h':520C 'h/a':441C 'h/va':457C 'hałajda':493C 'hcxf':21A 'high':444C,467C 'indefinit':227C,683C 'independ':475C 'inform':447C 'insid':126C,244C 'kamil':492C 'key':58B,77B,139C,142C,250C,267C,390C,636C,666C 'key.verify':159C 'l/at':452C 'l/pr':436C 'leav':121C,239C 'length':119C,228C,543C,566C,684C 'lenient':178C 'lib/rsa.js':158C 'long':224C,564C 'long-form':563C 'low':145C,253C,393C 'm8cv':20A 'malform':42B 'match':338C,380C 'messag':293C 'minim':118C,223C,541C 'n':442C,461C 'n/ac':435C,451C 'n/i':440C 'n/s':438C 'n/sa':460C 'n/sc':458C 'n/si':459C 'n/ui':437C,454C 'n/vc':455C 'n/vi':456C 'neither':190C 'node':26A,31B,39B,153C,362C 'node-forg':30B,38B,152C,361C 'node-forge':25A 'node.js':33B 'non':10A,102C,117C,212C,222C,230C,540C,679C,688C 'non-canon':9A,101C,229C,678C 'non-minim':116C,221C,539C 'non-nul':211C,687C 'null':111C,201C,213C,329C,525C,576C,611C,689C 'object':642C 'oid':232C,322C,508C,575C,692C 'one':300C,339C,675C 'oren':478C 'orenyomtov':480C 'other':200C 'p/pr':453C 'packag':34B 'pad':171C,234C,691C 'paramet':112C,202C,219C,330C,526C,612C,690C 'pars':172C 'parser':180C 'patch':358C 'per':677C 'pkcs':3A,97C 'pkcs1':51B,81C,165C,290C,585C,650C 'pkcs7':35B 'posit':220C 'privat':76B,138C,266C 'proof':498C 'public':60B,146C,254C,394C 'publickey.verify':86C,602C 'pzartech':494C 'rate':465C,470C 're':368C 're-encod':367C 'recov':174C,299C,335C 'refer':401C 'regress':655C 'relat':416C 'remov':169C 'report':476C,613C 'requir':191C,333C,374C 'research':491C 'return':605C 'rfc':277C,381C 'room':626C 'rsa':2A,36B,57B,141C,249C,389C 'rsassa':50B,80C,164C,649C 'rsassa-pkcs1-v1':49B,79C,163C,648C 'scheme':90C,168C 'section':279C,301C,383C 'see':273C 'sever':429C,469C 'sha':506C 'shape':681C 'signatur':6A,54B,69B,84C,132C,260C,283C,399C,581C,604C,631C,669C 'similar':621C 'slack':622C 'structur':185C 'style':271C 'su':693C 'subidentifi':235C 'summari':78C 'test':656C,676C 'tests/unit/rsa.js':657C 'throw':640C 'trail':236C 'true':606C 'u/c':439C 'use':92C,388C,614C,662C 'v1':52B,82C,166C,291C,586C,651C 'v1.5':5A 'valid':73B,601C,647C 'valu':216C,654C 'verif':55B,85C,99C,197C,331C,365C,400C,639C 'verifi':71B,281C,599C 'version':464C 'via':8A 'way':571C 'whose':582C 'without':74B,136C,264C,328C 'workaround':385C 'www.cve.org':426C 'www.cve.org/cverecord?id=cve-2014-1568':425C 'www.rfc-editor.org':403C,406C 'www.rfc-editor.org/rfc/rfc8017#section-8.2.2':402C 'www.rfc-editor.org/rfc/rfc8017#section-9.2':405C 'x.509':94C 'x509':37B 'yen':483C 'yomtov':479C","nicknames":[],"mitigations":[],"who_affected":"Applications that use node-forge to verify RSASSA-PKCS1-v1_5 signatures, including via publicKey.verify(), X.509 certificate chains and PKCS#7 signatures. Exposure requires the verifying RSA public key to have a low public exponent such as e=3; keys with larger exponents are not practically affected according to the advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nodeforge"],"ptokens":["forge","node"],"labels":["cwe347","high","nodeforge","nodejs","npm","package","pkcs7","rsa","x509"],"campaign_type":null,"search_a":"'-119192':16A,24A '-2026':15A,23A '1':4A '6qrw':19A 'canon':11A 'cve':14A,22A 'digestinfo':12A 'encod':13A 'forg':1A 'forge':27A 'forgeri':7A 'ghsa':18A 'ghsa-6qrw-m8cv-hcxf':17A 'hcxf':21A 'm8cv':20A 'node':26A 'node-forge':25A 'non':10A 'non-canon':9A 'pkcs':3A 'rsa':2A 'signatur':6A 'v1.5':5A 'via':8A","search_b":"'-347':29B '3':63B '5':53B 'accept':41B 'attack':65B 'ber':43B 'cwe':28B 'digestinfo':47B 'e':62B 'encod':44B 'expon':61B 'forg':32B,40B,67B 'key':58B,77B 'malform':42B 'node':31B,39B 'node-forg':30B,38B 'node.js':33B 'packag':34B 'pkcs1':51B 'pkcs7':35B 'privat':76B 'public':60B 'rsa':36B,57B 'rsassa':50B 'rsassa-pkcs1-v1':49B 'signatur':54B,69B 'v1':52B 'valid':73B 'verif':55B 'verifi':71B 'without':74B 'x509':37B","search_c":"'-1568':276C '-2014':275C '-2026':356C,409C,420C '-256':507C '-33894':421C '-85393':357C,410C '/av':434C,450C '/cverecord?id=cve-2014-1568':427C '/digitalbazaar/forge/security/advisories/ghsa-ppp5-5v6c-4jwp':424C '/rfc/rfc8017#section-8.2.2':404C '/rfc/rfc8017#section-9.2':407C '00':550C,560C,589C,593C '01':514C,519C,590C '02':518C,534C '03':516C '04':517C,537C,551C,561C '05':207C,533C,549C,559C,616C '06':509C '09':510C '0d':548C,558C '0f':532C '1':665C '1.4.1':155C,364C,505C,638C '20':538C,552C,562C '22mc':353C,414C '2g46':352C,413C '3':149C,257C,397C,635C '3.1':431C,433C,473C '30':529C,531C,544C,547C,555C,557C '31':546C,556C '32':522C '33':530C '4.0':446C,449C '40':208C,617C '48':513C '5':83C,167C,292C,587C,652C '60':511C '64':209C,618C '65':515C '6gwp':354C,415C '7':98C '7.5':443C '8.2':462C '8.2.2':280C,384C '8017':278C,382C '81':545C '86':512C '9.2':302C 'accept':100C,128C,198C,246C,503C,568C 'add':309C 'algorithm':321C 'allow':131C,259C 'also':91C,682C 'among':199C 'anthrop':490C 'antonlisson':495C 'asn.1':641C 'asn1.fromder':181C 'asn1.validate':187C 'attack':123C,241C,625C 'attacker-control':122C,240C 'ber':104C,179C 'berserk':268C,428C 'bleichenbach':270C 'bleichenbacher-styl':269C 'block':588C,673C 'brechard':497C 'bronson':482C 'byte':125C,205C,210C,237C,243C,343C,345C,377C,379C,523C,608C,619C 'byte-for-byt':376C 'calif.io':484C 'canon':103C,193C,231C,553C,658C,680C 'certif':95C 'chang':348C 'check':183C,660C 'claud':488C 'collabor':486C 'compar':295C 'concept':500C 'construct':215C,628C,685C 'contain':595C,645C 'content':114C,204C,528C,607C 'control':124C,242C 'credit':474C 'cve':274C,355C,408C,419C 'cvss':430C,432C,445C,448C,472C 'default':89C,162C 'defin':303C 'der':194C,313C 'der-encod':312C 'detail':156C 'digest':320C,325C,524C,578C,603C 'digestalgorithm':574C 'digestinfo':108C,129C,175C,247C,305C,317C,336C,372C,501C,542C,594C,653C,659C 'digestinfovalid':189C 'e':148C,256C,396C,634C,664C 'e.g':206C,615C 'ef':536C 'emsa':289C,584C 'emsa-pkcs1-v1':288C,583C 'encod':105C,195C,233C,285C,306C,314C,342C,369C,502C,598C,672C 'encodedigestinfo':310C 'equal':670C 'expect':287C,316C,371C 'expon':147C,255C,395C 'ff':591C,592C 'field':579C 'fireblock':481C 'fix':150C,308C,349C,359C,418C 'follow':471C 'forg':135C,154C,263C,363C,630C 'forgeri':272C 'form':225C,554C,565C 'ghsa':351C,412C 'ghsa-2g46-22mc-6gwp':350C,411C 'github.com':423C 'github.com/digitalbazaar/forge/security/advisories/ghsa-ppp5-5v6c-4jwp':422C 'give':623C 'h':520C 'h/a':441C 'h/va':457C 'hałajda':493C 'high':444C,467C 'indefinit':227C,683C 'independ':475C 'inform':447C 'insid':126C,244C 'kamil':492C 'key':139C,142C,250C,267C,390C,636C,666C 'key.verify':159C 'l/at':452C 'l/pr':436C 'leav':121C,239C 'length':119C,228C,543C,566C,684C 'lenient':178C 'lib/rsa.js':158C 'long':224C,564C 'long-form':563C 'low':145C,253C,393C 'match':338C,380C 'messag':293C 'minim':118C,223C,541C 'n':442C,461C 'n/ac':435C,451C 'n/i':440C 'n/s':438C 'n/sa':460C 'n/sc':458C 'n/si':459C 'n/ui':437C,454C 'n/vc':455C 'n/vi':456C 'neither':190C 'node':153C,362C 'node-forg':152C,361C 'non':102C,117C,212C,222C,230C,540C,679C,688C 'non-canon':101C,229C,678C 'non-minim':116C,221C,539C 'non-nul':211C,687C 'null':111C,201C,213C,329C,525C,576C,611C,689C 'object':642C 'oid':232C,322C,508C,575C,692C 'one':300C,339C,675C 'oren':478C 'orenyomtov':480C 'other':200C 'p/pr':453C 'pad':171C,234C,691C 'paramet':112C,202C,219C,330C,526C,612C,690C 'pars':172C 'parser':180C 'patch':358C 'per':677C 'pkcs':97C 'pkcs1':81C,165C,290C,585C,650C 'posit':220C 'privat':138C,266C 'proof':498C 'public':146C,254C,394C 'publickey.verify':86C,602C 'pzartech':494C 'rate':465C,470C 're':368C 're-encod':367C 'recov':174C,299C,335C 'refer':401C 'regress':655C 'relat':416C 'remov':169C 'report':476C,613C 'requir':191C,333C,374C 'research':491C 'return':605C 'rfc':277C,381C 'room':626C 'rsa':141C,249C,389C 'rsassa':80C,164C,649C 'rsassa-pkcs1-v1':79C,163C,648C 'scheme':90C,168C 'section':279C,301C,383C 'see':273C 'sever':429C,469C 'sha':506C 'shape':681C 'signatur':84C,132C,260C,283C,399C,581C,604C,631C,669C 'similar':621C 'slack':622C 'structur':185C 'style':271C 'su':693C 'subidentifi':235C 'summari':78C 'test':656C,676C 'tests/unit/rsa.js':657C 'throw':640C 'trail':236C 'true':606C 'u/c':439C 'use':92C,388C,614C,662C 'v1':82C,166C,291C,586C,651C 'valid':601C,647C 'valu':216C,654C 'verif':85C,99C,197C,331C,365C,400C,639C 'verifi':281C,599C 'version':464C 'way':571C 'whose':582C 'without':136C,264C,328C 'workaround':385C 'www.cve.org':426C 'www.cve.org/cverecord?id=cve-2014-1568':425C 'www.rfc-editor.org':403C,406C 'www.rfc-editor.org/rfc/rfc8017#section-8.2.2':402C 'www.rfc-editor.org/rfc/rfc8017#section-9.2':405C 'x.509':94C 'yen':483C 'yomtov':479C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T15:57:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6qrw-m8cv-hcxf","url":"https://github.com/advisories/GHSA-6qrw-m8cv-hcxf","severity":"high","published_at":"2026-11-10T15:57:34+00:00","modified_at":"2026-11-10T15:57:35+00:00","first_seen_at":"2026-11-10T15:58:11+00:00","fetched_at":"2026-11-10T15:58:55+00:00","note":null}],"documents":[{"id":115926,"url":"https://api.github.com/repos/digitalbazaar/forge/security-advisories/GHSA-6qrw-m8cv-hcxf","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":115927,"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-2g46-22mc-6gwp","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":115928,"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6qrw-m8cv-hcxf","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":115929,"url":"https://github.com/digitalbazaar/forge/commit/2bce9d477a2ff436e86ff9694ae999f1552aa2bb","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":26550,"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}