Excessive Recursion Vulnerability in Node-Forge Library by Digital Bazaar
CVE-2026-119191
7.5HIGH
What is CVE-2026-119191?
The node-forge library, which implements Transport Layer Security in JavaScript, has a vulnerability related to its ASN.1 decoding processes. Specifically, prior to version 1.4.1, the method asn1.fromDer() failed to consistently enforce the maxDepth setting while decoding nested BIT STRINGs. This oversight allowed for crafted DER inputs that could invoke excessive recursion, leading to increased CPU usage and potential denial-of-service conditions. Users should update to version 1.4.1 or later to mitigate this issue.
Affected Version(s)
forge < 1.4.1