Vulnerability Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Digitalbazaar | Forge | < 1.4.1 |
Related Weaknesses (CWE)
References
- https://github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270Patch
- https://github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a3631Patch
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.1Release Notes
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-119191?
CVE-2026-119191 is a vulnerability with a CVSS score of 7.5 (HIGH). Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to p...
How severe is CVE-2026-119191?
CVE-2026-119191 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119191?
Check the references section above for vendor advisories and patch information. Affected products include: Digitalbazaar Forge.