Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118777 · GHSA-6wvx-3r32-xmcg

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

Risk score
42/100
CVSS
4.8 v3.1
Exploit chance (30 days)
0.3%
Published
29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlle…
Affected
node-forge (npm) <= 1.4.0
Fix
Upgrade node-forge to 1.4.1 or later.
Exploitation
Public proof of concept

Story map

Story map: node-forgeTHE FLAWSTHE FIXCVE-2026-118777Forge: Prototype Pollution inforge.http cookie handling via amalicious Set-CookieCVSS 4.8 · EPSS 0%CVE-2026-118779Forge: Regular expressiondenial of service in PEMdecoding (pem.decode)CVSS 7.5 · EPSS 1%CVE-2026-119188Forge: Denial of service in TLSrecord processing via a recordinterleaved with a…CVSS 7.5 · EPSS 0%CVE-2026-119190Forge: X.509 basicConstraintsbypass inverifyCertificateChain() via…CVSS 7.4 · EPSS 0%Upgrade node-forge1.4.1or later on your release lineWho is exposed{'products': ['Forge','node-forge'], 'packages':[{'ecosystem': 'npm', 'name':'node-forge', 'versions': ['<=1.4.0']}]}AMBER · PATCH THIS WEEKnode-forgeA regular expression denial ofservice vulnerability in Forge'sPEM decoding (pem.decode)allows an attacker to consumeexcessive CPU with a longmalformed message, causing adenial of service.Where it standsPublic proof of conceptCONNECTS TOSame weaknessPrototype pollution (CWE-1321)50 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

node-forge: Amber, patch this week. A regular expression denial of service vulnerability in Forge's PEM decoding (pem.decode) allows an attacker to consume excessive CPU with a long malformed message, causing a denial of service.

The flaws

  • CVE-2026-118777: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie (CVSS 4.8 · EPSS 0%)
  • CVE-2026-118779: Forge: Regular expression denial of service in PEM decoding (pem.decode) (CVSS 7.5 · EPSS 1%)
  • CVE-2026-119188: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message (CVSS 7.5 · EPSS 0%)
  • CVE-2026-119190: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 (CVSS 7.4 · EPSS 0%)

The fix

Upgrade node-forge: 1.4.1 or later on your release line

Who is exposed: {'products': ['Forge', 'node-forge'], 'packages': [{'ecosystem': 'npm', 'name': 'node-forge', 'versions': ['<= 1.4.0']}]}

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 4.8 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
node-forgenpm<= 1.4.01.4.1

References

Original description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.

Last activity 30 Oct 2026. Patch Forecast updates every hour.