Vulnerability in Node-Forge Affects OID Encoding

CVE-2026-118775

What is CVE-2026-118775?

The Node-Forge library, which implements Transport Layer Security in JavaScript, has a vulnerability in its asn1.oidToDer() function prior to version 1.4.1. This issue allows an application that processes untrusted OID strings to potentially encode a different trusted OID, undermining security validations. This could result in unauthorized access or manipulation of sensitive data, as the integrity of the OID checks is compromised. The issue has been rectified in version 1.4.1, emphasizing the need for users to update their libraries to maintain security.

References