node-forge vulnerabilities

In node-forge prior to 1.4.1, ASN.1 decoding inside BIT STRING values did not consistently apply the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer().

In node-forge prior to 1.4.1, deprecated extension OIDs 2.5.29.10 and 2.5.29.13 were parsed as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. If a trusted CA issues a certificate carrying an attacker-supplied deprecated-OID extension before the genuine basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names.

Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when the certificate also carried a keyUsage extension. An attacker holding that CA's private key or a subordinate CA certificate could construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). This is fixed in version 1.4.1.

In node-forge prior to 1.4.1, forge.tls.createConnection() continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail.

In node-forge prior to 1.4.1, received TLS records were processed recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service.

Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption via forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like value, and the authentication tag was empty or missing, decipher.finish() accepted unauthenticated ciphertext. This is fixed in version 1.4.1.

In node-forge before 1.4.1, a PKCS#12 MAC or password-based encryption iteration count of zero or less was accepted. pki.pbe.generatePkcs12Key() then returned a constant key independent of password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected.

In node-forge before 1.4.1, the bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue.

In node-forge prior to 1.4.1, pki.verifyCertificateChain() modified the CA store while testing certificates sharing a subject name. A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail.

In node-forge before 1.4.1, pem.decode() in lib/pem.js used polynomial-time regular expressions, including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service.

In node-forge before 1.4.1, the TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This affects forge.tls.createConnection(), c.session.serverCertificate, and RSA key exchange.

In node-forge before 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected.

In node-forge prior to 1.4.1, PKCS#7 padding validation during CBC and ECB decryption checked only the final padding byte. Zero, oversized, or mismatched padding bytes were accepted, potentially silently removing up to four plaintext blocks.

In node-forge prior to 1.4.1, asn1.oidToDer() did not range-check the first two arcs of an OID. An application accepting an untrusted OID string, checking it, and then encoding it with asn1.oidToDer() could emit DER representing a different, trusted OID.

In node-forge prior to 1.4.1, certificate.verify(child) selected RSA padding and RSASSA-PSS parameters from the issuer certificate rather than the child certificate. A child labeled RSASSA-PSS could be accepted with a PKCS#1 v1.5 signature when the issuer used PKCS#1 v1.5.

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.

A vulnerability in node-forge before version 1.4.0 allows bypassing RFC 5280 basicConstraints requirements during certificate chain verification. The lack of enforcement enables any leaf certificate (without basicConstraints and keyUsage extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.

The node-forge library before version 1.4.0 accepts non-canonical Ed25519 signatures where the scalar S is not reduced modulo the group order (S >= L). Both a valid signature and its S+L variant are considered valid, while the OpenSSL-backed implementation rejects the S+L variant as per the specification.

The node-forge library before version 1.4.0 has a vulnerability in RSASSA PKCS#1 v1.5 signature verification for low public exponent keys (e=3). Attackers can forge signatures by inserting garbage bytes into the ASN structure, enabling Bleichenbacher-style forgery. This issue is similar to CVE-2022-24771 but differs in the location of the inserted bytes.

A Denial of Service (DoS) vulnerability exists in node-forge before version 1.4.0 due to an infinite loop in the BigInteger.modInverse() function. Calling this function with a zero value causes the process to hang indefinitely and consume 100% CPU.

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.

An integer overflow vulnerability in node-forge versions 1.3.1 and below allows remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. Due to 32-bit bitwise truncation, these arcs may be decoded as smaller, trusted OIDs, enabling bypass of downstream OID-based security decisions. The issue is patched in version 1.3.2.

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures that desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.