Login Request a demo
FO
Product
forge
by digitalbazaar · last CVE Oct 29, 2026
28
CVEs
0
On KEV
9.1
Max CVSS
15
New 30D
Vulnerabilities28In the news1Timeline
Severity mix
Critical 1High 15Medium 7Low 5
Severity
All severities28Critical1High15Medium7Low5
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add forge to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-0122
6.1
1%
Jan 6
forge is vulnerable to URL Redirection to Untrusted Site
Affected: before 1.0.0
CVE-2026-119189
New
5.9–Oct 29
Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
Affected: < 1.4.1
CVE-2026-119186
New
5.9–Oct 29
Forge: AES-GCM authentication bypass via unvalidated tagLength option
Affected: < 1.4.1
CVE-2026-118778
New
5.9–Oct 29
Forge: TLS client crash when the server sends no certificate
Affected: < 1.4.1
CVE-2025-66030
5.3
0%
Nov 26
node-forge ASN.1 OID Integer Truncation
Affected: < 1.3.2
CVE-2022-24773
5.3
1%
Mar 18
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Affected: before 1.3.0
CVE-2026-118777
New
4.8–Oct 29
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
Affected: < 1.4.1
Showing 7