High severity · published Oct 29, 2026
CVE-2026-119191
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
New
7.5
CVSS
–
EPSS
No
On KEV
Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
forge · digitalbazaar
< 1.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119191
github.com
https://github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4b
github.com
https://github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7
github.com
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
github.com
https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29
More from forge
9.1
CVE-2026-33896
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
8.6
CVE-2025-12816
No description published yet
7.5
CVE-2026-119188
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
7.5
CVE-2026-119187
Forge: Denial of service in TLS record processing via call stack exhaustion
7.5
CVE-2026-118782
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count