Skip to content
OpenAdvisories

Package · Ubuntu

node-node-forge

27 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-119189

    Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension.…

    digitalbazaar forge node-node-forge Ubuntu
  • Medium 5.9
    CVE-2026-119186

    Forge: AES-GCM authentication bypass via unvalidated tagLength option

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an ap…

    digitalbazaar forge node-node-forge node-forge Ubuntu npm
  • Medium 5.9
    CVE-2026-118778

    Forge: TLS client crash when the server sends no certificate

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or …

    digitalbazaar forge node-node-forge node-forge Ubuntu npm
  • Medium 4.8
    CVE-2026-118777

    Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could …

    digitalbazaar forge node-node-forge node-forge Ubuntu npm
  • Medium 6.3
    CVE-2025-66030

    node-forge ASN.1 OID Integer Truncation

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs…

    digitalbazaar forge node-node-forge node-forge Debian Ubuntu npm
  • Medium 5.3
    CVE-2022-24773

    Improper Verification of Cryptographic Signature in `node-forge`

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to succ…

    digitalbazaar forge node-node-forge node-forge Debian Ubuntu npm