node-forge (npm)
Advisories
38
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.4.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install node-forge@1.4.1yarn
yarn add node-forge@1.4.1pnpm
pnpm add node-forge@1.4.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-4642-5mcj-2rqw Forge: ASN.1 OID first arc truncation in asn1.oidToDer |
Low EPSS 0.31% |
<= 1.4.0 | No fix yet |
| GHSA-4642-5mcj-2rqw Forge: ASN.1 OID first arc truncation in asn1.oidToDer |
Low EPSS 0.31% |
< 1.4.1 | 1.4.1 |
| GHSA-6wvx-3r32-xmcg Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie |
Medium EPSS 0.26% |
< 1.4.1 | 1.4.1 |
| GHSA-6wvx-3r32-xmcg Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie |
Medium EPSS 0.26% |
<= 1.4.0 | No fix yet |
| GHSA-525v-9gp9-w22h Forge: TLS client crash when the server sends no certificate |
Medium EPSS 0.20% |
<= 1.4.0 | No fix yet |
| GHSA-525v-9gp9-w22h Forge: TLS client crash when the server sends no certificate |
Medium EPSS 0.20% |
< 1.4.1 | 1.4.1 |
| GHSA-7wch-p9px-956x Forge: Regular expression denial of service in PEM decoding (pem.decode) |
High EPSS 0.56% |
< 1.4.1 | 1.4.1 |
| GHSA-7wch-p9px-956x Forge: Regular expression denial of service in PEM decoding (pem.decode) |
High EPSS 0.56% |
<= 1.4.0 | No fix yet |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) |
Low EPSS 0.12% |
< 1.4.1 | 1.4.1 |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) |
Low EPSS 0.12% |
<= 1.4.0 | No fix yet |
| GHSA-4487-j8r4-4g2f Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store |
Low EPSS 0.17% |
< 1.4.1 | 1.4.1 |
| GHSA-4487-j8r4-4g2f Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store |
Low EPSS 0.17% |
<= 1.4.0 | No fix yet |
| GHSA-5cwg-6vw7-rj6p Forge: AES-GCM authentication bypass via unvalidated tagLength option |
Medium EPSS 0.21% |
<= 1.4.0 | No fix yet |
| GHSA-5cwg-6vw7-rj6p Forge: AES-GCM authentication bypass via unvalidated tagLength option |
Medium EPSS 0.21% |
< 1.4.1 | 1.4.1 |
| GHSA-jc66-7q78-782g Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count |
High EPSS 0.12% |
<= 1.4.0 | No fix yet |
| GHSA-jc66-7q78-782g Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count |
High EPSS 0.12% |
< 1.4.1 | 1.4.1 |
| GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message |
High EPSS 0.41% |
<= 1.4.0 | No fix yet |
| GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message |
High EPSS 0.41% |
< 1.4.1 | 1.4.1 |
| GHSA-5x38-2vff-x55p Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 |
High EPSS 0.25% |
< 1.4.1 | 1.4.1 |
| GHSA-5x38-2vff-x55p Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 |
High EPSS 0.25% |
<= 1.4.0 | No fix yet |
| GHSA-hqq3-7jhf-c5jx Forge: Denial of service in TLS record processing via call stack exhaustion |
High EPSS 0.41% |
<= 1.4.0 | No fix yet |
| GHSA-hqq3-7jhf-c5jx Forge: Denial of service in TLS record processing via call stack exhaustion |
High EPSS 0.41% |
< 1.4.1 | 1.4.1 |
| GHSA-2328-f5f3-gj25 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) |
Critical EPSS 0.36% |
< 1.4.0 | 1.4.0 |
| GHSA-q67f-28xg-22rw Forge has signature forgery in Ed25519 due to missing S > L check |
High EPSS 0.53% |
< 1.4.0 | 1.4.0 |
| GHSA-86w9-cpqp-85rv node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements |
High EPSS 0.48% |
<= 1.4.0 | No fix yet |
| GHSA-86w9-cpqp-85rv node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements |
High EPSS 0.48% |
< 1.4.0 | 1.4.0 |
| GHSA-5m6q-g25r-mvwx Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input |
High EPSS 0.61% |
< 1.4.0 | 1.4.0 |
| GHSA-554w-wpv2-vw27 node-forge has ASN.1 Unbounded Recursion |
High EPSS 0.45% |
< 1.3.2 | 1.3.2 |
| GHSA-65ch-62r8-g69g node-forge is vulnerable to ASN.1 OID Integer Truncation |
Medium EPSS 0.33% |
< 1.3.2 | 1.3.2 |
| GHSA-5gfm-wpxj-wjgq node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization |
High EPSS 0.58% |
< 1.3.2 | 1.3.2 |
| GHSA-2r2c-g63r-vccr Improper Verification of Cryptographic Signature in `node-forge` |
Medium EPSS 0.96% |
< 1.3.0 | 1.3.0 |
| GHSA-x4jg-mjrx-434g Improper Verification of Cryptographic Signature in node-forge |
High EPSS 1.11% |
< 1.3.0 | 1.3.0 |
| GHSA-cfm4-qjh2-4765 Improper Verification of Cryptographic Signature in node-forge |
High EPSS 0.78% |
< 1.3.0 | 1.3.0 |
| GHSA-8fr3-hfg3-gpgp Open Redirect in node-forge |
Medium EPSS 0.87% |
< 1.0.0 | 1.0.0 |
| GHSA-5rrq-pxf6-6jx5 Prototype Pollution in node-forge debug API. |
Low | < 1.0.0 | 1.0.0 |
| GHSA-wxgw-qj99-44c2 Prototype Pollution in node-forge util.setPath API |
Low | < 0.10.0 | 0.10.0 |
| GHSA-gf8q-jrpm-jvxq URL parsing in node-forge could lead to undesired behavior. |
Low | < 1.0.0 | 1.0.0 |
| GHSA-92xj-mqp7-vmcj Prototype Pollution in node-forge |
Critical EPSS 3.19% |
< 0.10.0 | 0.10.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor