Transport Layer Security Vulnerability in Forge by Digital Bazaar
CVE-2026-118780

3.7LOW

Key Information:

Vendor: Digitalbazaar
Status: Forge
Vendor: CVE Published:; 29 October 2026

🔔 Create Digitalbazaar Vulnerability Alert

What is CVE-2026-118780?

Forge, a widely used implementation of Transport Layer Security in JavaScript, has a vulnerability where the methods pki.verifyCertificateChain() and pki.createCaStore() handle duplicate subject names incorrectly. This flaw can result in the accidental removal of trusted Certificate Authority (CA) certificates from the CA store. As a consequence, even future valid certificate chains may fail verification, leading to persistent application availability issues. This vulnerability has been addressed in version 1.4.1 of Forge.