Vulnerability in node-forge by Digital Bazaar Affects TLS Implementation
CVE-2026-118776

3.7LOW

Key Information:

Vendor

Digitalbazaar

Status
Forge
Vendor
CVE Published:
29 October 2026

What is CVE-2026-118776?

The node-forge library, a JavaScript implementation of Transport Layer Security, had a serious issue prior to version 1.4.1 where it improperly validated padding during CBC and ECB decryption modes. This flaw allowed malformed ciphertext to be accepted, resulting in up to four plaintext blocks being silently discarded. This integrity failure misled applications into treating successful decryption as valid, which could lead to unforeseen security risks. Version 1.4.1 resolves this vulnerability effectively.

Affected Version(s)

forge < 1.4.1

References

https://github.com/digitalbazaar/forge/security/advisorie...
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/commit/81774ff99e2...
x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.