JavaScript Transport Layer Security Vulnerability in Forge (node-forge)
CVE-2026-118777

4.8MEDIUM

Key Information:

Vendor: Digitalbazaar
Status: Forge
Vendor: CVE Published:; 29 October 2026

🔔 Create Digitalbazaar Vulnerability Alert

What is CVE-2026-118777?

The Forge (node-forge) library, used for implementing Transport Layer Security in JavaScript, contains a vulnerability that arises from improper handling of Set-Cookie headers. This issue allows an attacker to utilize cookie names such as proto or constructor. By exploiting this flaw, an adversary could manipulate the Object.prototype, potentially disrupting the integrity of the JavaScript environment. This vulnerability impacts applications utilizing forge.http and forge.xhr, but does not affect those that do not. Users are advised to upgrade to version 1.4.1 to mitigate these risks.