Security Flaw in Node-Forge's PKCS#12 Handling by Digital Bazaar

CVE-2026-118782

What is CVE-2026-118782?

Node-Forge, a JavaScript implementation of Transport Layer Security, had a security misconfiguration that allowed users to pass a PKCS#12 MAC or password-based encryption iteration count of zero or less. This flaw led to the creation of a constant key that was independent of both the password and salt entered. As a result, it permitted crafted PKCS#12 input to bypass critical password-based integrity checks. Additionally, predictable encryption keys and initialization vectors compromised various PKCS#12 PBE configurations. The issue has been addressed in version 1.4.1.

References