Skip to content
OpenAdvisories

Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.

Affected products

VendorProductAffectedFixed
digitalbazaar forge < 1.4.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS node-node-forge No fix yet —
Ubuntu 20.04 LTS node-node-forge No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Ansible Automation Platform Inside 2 python3.12-click 8.3.3-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform Inside 2 python3.12-cryptography 46.0.7-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform Inside 2 receptor 1.6.5-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform Inside 2 receptorctl 1.6.5-1.el9ap RHSA-2026:24762
Red Hat Ansible Automation Platform Developer 2 automation-controller +1 4.7.12-1.el9ap RHSA-2026:24762
Red Hat Ansible Automation Platform Developer 2 python3-click 8.3.3-1.el10ap RHSA-2026:24762
Red Hat Ansible Automation Platform Developer 2 python3.12-click 8.3.3-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform Developer 2 python3.12-cryptography 46.0.7-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform Developer 2 receptor 1.6.5-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform Developer 2 receptorctl 1.6.5-1.el9ap RHSA-2026:24762
Red Hat Ansible Automation Platform 2 automation-controller +3 4.7.12-1.el9ap RHSA-2026:24762
Red Hat Ansible Automation Platform 2 automation-controller-venv-tower 4.6.29-2.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform 2 automation-gateway-proxy 2.6.14-3.el9ap RHSA-2026:24762
Red Hat Ansible Automation Platform 2 automation-gateway-proxy-server 2.5.10-6.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform 2 automation-gateway-server 2.5.20260422-3.el8ap RHSA-2026:24761
Red Hat Ansible Automation Platform 2 automation-platform-ui 2.6.9-1.el9ap RHSA-2026:24762
Red Hat Ansible Automation Platform 2 python3-click 8.3.3-1.el10ap RHSA-2026:24762
Red Hat Ansible Automation Platform 2 python3.12-click 8.3.3-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform 2 python3.12-cryptography 46.0.7-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform 2 python3.12-pillow 12.2.0-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform 2 receptor 1.6.5-1.el8ap RHSA-2026:24762, RHSA-2026:24761
Red Hat Ansible Automation Platform 2 receptorctl 1.6.5-1.el9ap RHSA-2026:24762

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kubeflow-centraldashboard 1.10.0-r18 —
Wolfi rolling kubeflow-pipelines-frontend 2.16.0-r11 —
Wolfi rolling opensearch-dashboards-3 3.5.0-r11 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm node-forge < 1.4.0 1.4.0 GHSA-5m6q-g25r-mvwx

Advisories 3

References