node-forge

### Summary `decipher.finish()` in CBC and ECB mode accepted malformed PKCS#7 padding: only the last byte was checked, against a limit of four blocks, so mismatched padding bytes, a zero count and oversized counts were accepted and up to four blocks of plaintext could be silently removed. Fixed in node-forge 1.4.1. ### Details `modes.cbc.prototype.unpad()` and `modes.ecb.prototype.unpad()` in `lib/cipherModes.js` read the last decrypted byte as the PKCS#7 padding count, rejected it only if it was larger than `blockSize << 2` (64 for AES, 32 for DES), and then removed that many bytes. They did

CVE: CVE-2026-118776

### Summary `ed25519.verify()` does not reject public keys of small order, such as the identity point. Under such a key, a signature with `S = 0` and a small-order `R` verifies for many messages, or for every message with the identity key, without any private key. Fixed in node-forge 1.4.3. ### Details `crypto_sign_open()` in `lib/ed25519.js` decodes the public key `A` with `unpackneg()`, which only checks that the point is on the curve, and then checks `R == [S]B - [k]A` with `k = SHA-512(R || A || M)`. Nothing rejects public keys of small order: the identity point, the other 7 points of ord

CVE: CVE-2026-125335

`forge.http` trims response header and `Set-Cookie` values with the regular expression `/\s*$/`, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a `forge.http` client for minutes with one large response header. Fixed in node-forge 1.4.3. ### Details `_trimString()` in `lib/http.js` removes trailing whitespace with `str.replace(/\s*$/, '')`. On a string of n whitespace characters followed by a non-whitespace character, the regular expression engine tries a match at each of the n positions and scans the rest of the run

CVE: CVE-2026-125333

### Summary RSASSA-PKCS1-v1_5 signature verification (`publicKey.verify()` with the default scheme, also used by X.509 certificate and PKCS#7 verification) accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-minimal lengths. These leave attacker-controlled bytes inside an accepted DigestInfo, which allows signatures to be forged without the private key for RSA keys with a low public exponent (e=3). Fixed in node-forge 1.4.1. ### Details In `lib/rsa.js`, `key.verify()` with the default `RSASSA-PKCS1-V1_5` scheme removes the padding, parses the r

CVE: CVE-2026-119192

### Summary When verifying a certificate, node-forge chose the RSA padding scheme (PKCS#1 v1.5 or RSASSA-PSS) and PSS parameters from the issuer certificate's own signature algorithm instead of the certificate being verified. A certificate labeled as signed with RSASSA-PSS could pass `verifyCertificateChain()` with a PKCS#1 v1.5 signature. Fixed in node-forge 1.4.1. ### Details `certificate.verify(child)` in `lib/x509.js` hashes the child's TBSCertificate with the digest of the child's signature algorithm, then calls `_verifySignature()` with the issuer certificate. `_verifySignature()` sel

CVE: CVE-2026-118774

### Summary `forge.pki.verifyCertificateChain()` enforces the `pathLenConstraint` of a CA certificate's `basicConstraints` extension only when that certificate also has a `keyUsage` extension. For a CA certificate with a `pathLenConstraint` and no `keyUsage`, chains with more intermediate CA certificates below it than the constraint allows are accepted. Fixed in node-forge 1.4.1. ### Details In `pki.verifyCertificateChain()` (`lib/x509.js`), the path length check for a CA certificate was guarded by `keyUsageExt !== null && 'pathLenConstraint' in bcExt`. The `keyUsage` test was originally a pr

CVE: CVE-2026-119189

### Summary A `forge.tls` client throws an uncaught `TypeError` from `connection.process()` when it receives a ServerHello while it has no session: after a `close_notify` alert or a call to `close()`, or before `handshake()` is called. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details `tls.handleHandshake()` in `lib/tls.js` updates the handshake digests with `c.session.md5.update(bytes)` before it calls the message handler. A client creates its session in `handshake()`, and `c.reset()` sets it to `null` when the conne

CVE: CVE-2026-125334

### Summary `asn1.fromDer()` decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the `maxDepth` recursion limit (an incomplete fix of CVE-2025-66031) and also decoded nested BIT STRINGs, keeping a full copy of the decoded contents at each level, so small crafted DER or PEM inputs (certificates, keys, PKCS structures) use excessive CPU time and memory and can abort the Node.js process. Fixed in node-forge 1.4.1. ### Details `asn1.fromDer()` attempts by default to decode the contents of primitive BIT STRINGs as ASN.1 (`decodeBitStrings`, default `true`). Two flaws in th

CVE: CVE-2026-119191

### Summary A `forge.tls` client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes `connection.process()` throw an uncaught `Error` when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details The client's ClientHello offers only the `null` compression method. `tls.parseHelloMessage()` in `lib/tls.js` stores the ServerHello's `compression_method` for the client without checking it (the cod

CVE: CVE-2026-125332

### Summary When a CA store created by `pki.createCaStore()` holds two or more certificates with the same subject name, `pki.verifyCertificateChain()` permanently removes those certificates from the store while trying each one as the issuer. A peer can send any certificate that names that subject as its issuer to make all later verifications against those CA certificates fail. Fixed in node-forge 1.4.1. ### Details `pki.verifyCertificateChain()` (`lib/x509.js`) asks the CA store for the issuer of each certificate with `caStore.getIssuer()`. When the store holds several certificates with the

CVE: CVE-2026-118780