CVE-2026-119191
7.5 HIGHpublic exploit availablePublished 2026-10-29 · Updated 2026-10-29
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-674
Public exploit & PoC references
- https://github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4b
- https://github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29
All references
- https://github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4b
- https://github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-102276PoC
- HIGHCVE-2026-102278PoC
- MEDIUMCVE-2026-107208PoC
- LOWCVE-2026-108331
- MEDIUMCVE-2026-88858
- HIGHCVE-2025-52290
- HIGHCVE-2026-100137
- HIGHCVE-2026-100138
Related by shared AI tags and CWE weakness class. Browse the full archive.