Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
Published: 2026-10-29
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service via Resource Exhaustion
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises when forge's ASN.1 decoder processes nested BIT STRINGs without properly enforcing the configured maxDepth limit, leading to uncontrolled recursion and quadratic memory usage, which can collapse system resources. Attackers can craft DER‑encoded data that triggers extensive CPU cycles and memory consumption during asn1.fromDer, thus denying service to the application or underlying system.

Affected Systems

digitalbazaar:forge, any JavaScript or Node.js application using forge prior to version 1.4.1 is affected. The issue exists in all earlier releases and is fixed in v1.4.1.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. EPSS is not available, but the exploit is straightforward once an application decodes an attacker‑controlled ASN.1 structure. The vulnerability is not currently listed in the CISA KEV catalog. Attackers are likely to target services that use forge to parse certificates or other ASN.1 structures, and crafted input can be supplied over network, file upload, or embedded data.

Generated by OpenCVE AI on October 29, 2026 at 20:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade forge to version 1.4.1 or later.
  • If upgrading is not possible, apply defensive input validation to reject overly nested BIT STRINGs before decoding.
  • Enable system‑wide resource limits for processes that load forge to mitigate denial of service impact.

Generated by OpenCVE AI on October 29, 2026 at 20:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Digitalbazaar
Digitalbazaar forge
Vendors & Products Digitalbazaar
Digitalbazaar forge

Thu, 29 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
Title Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
Weaknesses CWE-400
CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Digitalbazaar Forge
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-29T19:26:29.815Z

Reserved: 2026-10-29T16:04:48.728Z

Link: CVE-2026-119191

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-29T20:17:30.197

Modified: 2026-10-29T20:17:30.197

Link: CVE-2026-119191

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T20:30:18Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-674

    Uncontrolled Recursion