Denial of Service Vulnerability in Node-Forge's HTTP Implementation

CVE-2026-125333

What is CVE-2026-125333?

Node-Forge, a native implementation of Transport Layer Security in JavaScript, is vulnerable due to its handling of response header values and cookie names and values in the forge.http module. Affected versions from 0.1.2 to 1.4.3 use a regular expression with a quadratic time complexity in the _trimString() function, which can lead to severe performance degradation. An attacker can exploit this vulnerability by injecting a long sequence of whitespace followed by a non-whitespace character in a response header. This exploitation can cause significant delays in response processing by blocking the Node.js event loop or the browser tab for extended periods. The vulnerability arises only when applications utilize forge.http with a socket pool to interact with untrusted servers, as the module is not loaded through the standard method. This issue has been resolved in version 1.4.3.

References