Denial of Service Vulnerability in Node-Forge JavaScript Library
CVE-2026-118779

7.5HIGH

Key Information:

Vendor

Digitalbazaar

Status
Forge
Vendor
CVE Published:
29 October 2026

What is CVE-2026-118779?

The Node-Forge library, designed for Transport Layer Security in JavaScript, contains a vulnerability in its PEM decoding functionality. Versions prior to 1.4.1 use an insecure method in the pem.decode() function that fails to properly handle malformed input. This flaw can allow unauthenticated attackers to exploit the library by submitting specially crafted PEM data, leading to excessive CPU consumption and potential denial of service. Users are urged to upgrade to version 1.4.1 or later to mitigate this risk effectively.

Affected Version(s)

forge < 1.4.1

References

https://github.com/digitalbazaar/forge/security/advisorie...
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/commit/412345db583...
x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.