FO
Product
forge
28
CVEs
0
On KEV
9.1
Max CVSS
15
New 30D
Severity mix
Critical 1High 15Medium 7Low 5
Watch
Add forge to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33896 | 9.1 | Mar 27 | Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) Affected: < 1.4.0 |
| CVE-2025-12816 | 8.6 | Nov 25 | No description published yet Affected: through 1.3.1 |
| CVE-2026-119191 New | 7.5 | Oct 29 | Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer Affected: < 1.4.1 |
| CVE-2026-119188 New | 7.5 | Oct 29 | Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message Affected: < 1.4.1 |
| CVE-2026-119187 New | 7.5 | Oct 29 | Forge: Denial of service in TLS record processing via call stack exhaustion Affected: < 1.4.1 |
| CVE-2026-118782 New | 7.5 | Oct 29 | Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count Affected: < 1.4.1 |
| CVE-2026-118779 New | 7.5 | Oct 29 | Forge: Regular expression denial of service in PEM decoding (pem.decode) Affected: < 1.4.1 |
| CVE-2026-85393 | 7.5 | Sep 3 | node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding Affected: through 1.4.0 |
| CVE-2026-33895 | 7.5 | Mar 27 | Forge has signature forgery in Ed25519 due to missing S > L check Affected: < 1.4.0 |
| CVE-2026-33894 | 7.5 | Mar 27 | Forge has signature forgery in RSA-PKCS due to ASN.1 extra field Affected: < 1.4.0 |
| CVE-2026-33891 | 7.5 | Mar 27 | Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input Affected: < 1.4.0 |
| CVE-2025-66031 | 7.5 | Nov 26 | node-forge ASN.1 Unbounded Recursion Affected: < 1.3.2 |
| CVE-2022-24772 | 7.5 | Mar 18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript Affected: before 1.3.0 |
| CVE-2022-24771 | 7.5 | Mar 18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript Affected: before 1.3.0 |
| CVE-2026-119190 New | 7.4 | Oct 29 | Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 Affected: < 1.4.1 |
| CVE-2020-7720 | 7.3 | Sep 1 | The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function Affected: before 0.10.0 |
| CVE-2022-0122 | 6.1 | Jan 6 | forge is vulnerable to URL Redirection to Untrusted Site Affected: before 1.0.0 |
| CVE-2026-119189 New | 5.9 | Oct 29 | Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage Affected: < 1.4.1 |
| CVE-2026-119186 New | 5.9 | Oct 29 | Forge: AES-GCM authentication bypass via unvalidated tagLength option Affected: < 1.4.1 |
| CVE-2026-118778 New | 5.9 | Oct 29 | Forge: TLS client crash when the server sends no certificate Affected: < 1.4.1 |
| CVE-2025-66030 | 5.3 | Nov 26 | node-forge ASN.1 OID Integer Truncation Affected: < 1.3.2 |
| CVE-2022-24773 | 5.3 | Mar 18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript Affected: before 1.3.0 |
| CVE-2026-118777 New | 4.8 | Oct 29 | Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie Affected: < 1.4.1 |
| CVE-2026-118780 New | 3.7 | Oct 29 | Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store Affected: < 1.4.1 |
| CVE-2026-118776 New | 3.7 | Oct 29 | Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption Affected: < 1.4.1 |
| CVE-2026-118775 New | 3.7 | Oct 29 | Forge: ASN.1 OID first arc truncation in asn1.oidToDer Affected: < 1.4.1 |
| CVE-2026-118774 New | 3.7 | Oct 29 | Forge: Certificate signature verified with the issuer's RSA signature scheme Affected: < 1.4.1 |
| CVE-2026-118781 New | 2.9 | Oct 29 | Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) Affected: < 1.4.1 |
Showing 28