Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118775 · GHSA-4642-5mcj-2rqw

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Risk score
47/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oi…
Affected
node-forge (npm) <= 1.4.0
Fix
Upgrade node-forge to 1.4.1 or later.
Exploitation
Public proof of concept

Story map

Story map: node-forgeTHE FLAWSTHE FIXCVE-2026-118775Forge: ASN.1 OID first arctruncation in asn1.oidToDerCVSS 5.3 · EPSS 0%CVE-2026-119187Forge: Denial of service in TLSrecord processing via call stackexhaustionCVSS 7.5 · EPSS 0%CVE-2026-119191Denial of serviceCVSS 7.5 · EPSS 0%CVE-2026-118777Forge: Prototype Pollution inforge.http cookie handling via amalicious Set-CookieCVSS 6.5 · EPSS 0%Upgrade node-forge1.4.1or later on your release lineWho is exposed{'products': ['Forge','node-forge'], 'packages':[{'ecosystem': 'npm', 'name':'node-forge', 'vulnerable': '<=1.4.0'}], 'versions': ['<= 1.4.0']}AMBER · PATCH THIS WEEKnode-forgeA denial of service vulnerabilityexists in Forge (node-forge) dueto recursive TLS recordprocessing consuming the callstack, allowing a remote peer toexhaust the stack and cause anuncaught exception. An…Where it standsPublic proof of conceptCONNECTS TOSame weaknessInteger overflow (CWE-190)184 other warnings in 30 days →Same productEarlier node-forge warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

node-forge: Amber, patch this week. A denial of service vulnerability exists in Forge (node-forge) due to recursive TLS record processing consuming the call stack, allowing a remote peer to exhaust the stack and cause an uncaught exception. An attacker could exploit this vulnerability to cause a denial of service.

The flaws

  • CVE-2026-118775: Forge: ASN.1 OID first arc truncation in asn1.oidToDer (CVSS 5.3 · EPSS 0%)
  • CVE-2026-119187: Forge: Denial of service in TLS record processing via call stack exhaustion (CVSS 7.5 · EPSS 0%)
  • CVE-2026-119191: Denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-118777: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie (CVSS 6.5 · EPSS 0%)

The fix

Upgrade node-forge: 1.4.1 or later on your release line

Who is exposed: {'products': ['Forge', 'node-forge'], 'packages': [{'ecosystem': 'npm', 'name': 'node-forge', 'vulnerable': '<= 1.4.0'}], 'versions': ['<= 1.4.0']}

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
node-forgenpm<= 1.4.01.4.1

References

Original description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.

Last activity 30 Oct 2026. Patch Forecast updates every hour.