node-forge@1.3.1

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Certificate Validation via pki.verifyCertificateChain() in lib/x509.js, which does not decode or enforce the X.509 nameConstraints extension (OID 2.5.29.30) during certificate path validation. A certificate authority whose nameConstraints extension is marked non-critical can issue a leaf certificate with a subjectAltName dNSName or subject commonName outside its permitted subtrees or inside its excluded subtrees, and the chain passes verification. This allows an attacker holding such a CA's private key, or able to obtain a certificate issued under it, to impersonate arbitrary names - including in TLS peer verification via forge.tls - defeating the namespace restriction the constraint was intended to enforce.

Note: This is only exploitable when a name-constrained CA with a non-critical nameConstraints extension chains to a root trusted by the application, and the attacker controls that CA's private key or can obtain an out-of-scope certificate from it. Chains without nameConstraints are unaffected, and chains with a critical nameConstraints extension were already rejected.

Upgrade node-forge to version 1.4.3 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Uncaught Exception via tls.parseHelloMessage() in lib/tls.js, which stores the ServerHello's compression_method without validating it against the methods offered in the ClientHello. When the client subsequently handles ServerHelloDone, tls.createConnectionState() throws an uncaught Error('Unsupported compression algorithm.') for any compression method other than null (0) or deflate (1). Because the ServerHello is not yet authenticated at this point, a malicious server or an on-path attacker can set the compression byte to an unsupported value, causing connection.process() to throw and terminating the Node.js process in applications that do not catch the exception - including those using forge.tls.wrapSocket or forge.http.

Upgrade node-forge to version 1.4.3 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via ed25519.verify() in lib/ed25519.js, which does not reject public keys of small order. crypto_sign_open() decodes the public key A with unpackneg(), which only checks that the point is on the curve, and never validates that the key is not a small-order point (the identity point or the other 7 points of order 2, 4, or 8, including non-canonical encodings with y >= p). An attacker who can supply the public key can present a small-order key together with a signature where S = 0 and a small-order R, causing the verification equation R == [k](-A) to hold for many or all messages without knowledge of any private key. For the identity key specifically, the fixed signature R = identity, S = 0 verifies for every message.

Upgrade node-forge to version 1.4.3 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to NULL Pointer Dereference via tls.handleHandshake() in lib/tls.js, which attempts to update handshake digests via c.session.md5.update(bytes) when c.session is null. A client's session is set to null by c.reset() after a close_notify alert or a call to close(), and is also absent before handshake() is called. A malicious server or an on-path attacker can send a ServerHello record in any of these states, causing an uncaught TypeError to propagate out of connection.process() and terminate the Node.js process.

Note: Only forge.tls clients are affected; servers are not vulnerable because a server creates its session upon receiving a ClientHello.

Upgrade node-forge to version 1.4.3 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via _trimString() in lib/http.js, which removes trailing whitespace using the regular expression /\s*$/. On a string of n whitespace characters followed by a non-whitespace character, the engine attempts a match at each position and scans the remainder of the run each time, producing O(n^2) work. forge.http calls _trimString() on every response header value processed by response.readHeader() and on cookie names and values in response.getCookies(), with no limit on header size. A server or on-path attacker can send a large response header that blocks the client's event loop for minutes, denying service to everything else in the process.

Note: This is only exploitable by applications that use forge.http directly; forge.http is not loaded by require('node-forge') and requires a socket pool provided by the application.

Upgrade node-forge to version 1.4.3 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the certificate.verify method in lib/x509.js. An attacker can relabel an existing PKCS#1 v1.5 certificate as RSASSA-PSS and still have it pass chain verification, by altering the unsigned outer signatureAlgorithm field, because _verifySignature() selects the padding scheme from the issuer certificate's signatureOid and signatureParameters rather than from the scheme the child certificate declares. The signature must still come from the issuer's key, so no forgery is possible, and this only matters to applications that make decisions based on a certificate's declared signature algorithm, such as a policy that accepts only RSASSA-PSS.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the modes.cbc.prototype.unpad and modes.ecb.prototype.unpad methods in lib/cipherModes.js. An attacker can have malformed ciphertext accepted as valid and silently strip up to four blocks of trailing plaintext, by manipulating the final bytes of malleable CBC or ECB ciphertext, because the unpadding reads only the last byte as the padding count, rejects it only when it exceeds four blocks, and never verifies that the remaining padding bytes equal that count. This matters only when the application relies on decipher.finish() to decide whether decrypted data is valid, and the added capability is small because unauthenticated CBC and ECB ciphertext is already malleable.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Certificate Validation in the pki.verifyCertificateChain function in lib/x509.js. An attacker who controls a CA certificate that carries a pathLenConstraint but no keyUsage extension can place more intermediate CAs below it than the constraint permits and have the chain accepted, because the path-length check is guarded by keyUsageExt !== null && 'pathLenConstraint' in bcExt and is skipped whenever keyUsage is absent. This requires a trusted chain that contains such a constrained CA without keyUsage, which mainly arises in private PKIs since public web PKI CAs include keyUsage, and the attacker must hold that CA's key or obtain a CA certificate from it to issue the extra subordinates.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Uncontrolled Recursion in the asn1.fromDer function in lib/asn1.js. An attacker can drive CPU and memory high enough to abort the Node.js process with a small DER or PEM structure containing nested BIT STRINGs, because the default BIT STRING decode path in _fromDer() starts with an options object that omits maxDepth, so the depth check compares against undefined and never fires, and each nested BIT STRING's contents are deep-copied by asn1.create(), making memory grow quadratically with nesting depth. This triggers under default options through any API that parses DER or PEM, including pki.certificateFromPem(), pki.publicKeyFromPem(), the PKCS#7, PKCS#8, and PKCS#12 loaders, and server certificates received by the forge TLS client.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the pkcs12.pkcs12FromAsn1 function in lib/pkcs12.js and the pki.pbe.generatePkcs12Key key derivation in lib/pbe.js. An attacker can alter a PFX file, substitute certificates or an unencrypted private key, and compute a MAC that verifies under any password, by setting MacData.iterations to zero or less, because the PKCS#12 key derivation then runs its hash loop zero times and returns a constant that does not depend on the password or salt (the MAC key becomes the diversifier byte 0x03 repeated 20 times, and PBE derives constant key and IV bytes 0x01 and 0x02). This affects applications that import PKCS#12/PFX files or PKCS#8 encrypted keys from untrusted sources and rely on the MAC or on successful decryption to establish provenance, while PBES2 (PBKDF2) encrypted content is unaffected.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the modes.gcm.prototype.start method in lib/cipherModes.js. An attacker can have forged ciphertext accepted as authentic, and alter known plaintext to chosen values, by supplying an empty authentication tag, because a zero-like tagLength is stored without validation and afterFinish() computes truncate(16 % (tagLength / 8)), which for a zero value evaluates to 16 % 0 = NaN and empties the tag, so decipher.finish() compares two empty strings and returns true. This is reached only when the application calls forge.cipher.createDecipher('AES-GCM', ...) with a zero-like tagLength, such as one derived from the received tag length or an unset configuration value, while the default 128-bit tag and any fixed valid tagLength are unaffected.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Certificate Validation in the pki.verifyCertificateChain function in lib/x509.js. An attacker can get a non-CA certificate accepted as a CA, and then impersonate any server or client the verifier trusts, by placing a second basicConstraints extension under the deprecated OIDs 2.5.29.10 or 2.5.29.13 with cA set TRUE, because lib/oids.js maps those OIDs to the same name and cert.getExtension() returns the first name match, so chain verification reads the forged extension in place of the genuine 2.5.29.19 one. This requires a CA that the application trusts to issue a certificate carrying the attacker-supplied deprecated-OID extension, as when a CA copies extensions from certificate requests through an OpenSSL copy_extensions workflow, and node-forge still rejects the chain if that issuer adds a keyUsage extension without keyCertSign.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Uncontrolled Recursion in the TLS record processing in lib/tls.js, where connection.process() and the per-record-type handlers it dispatches through ctTable (tls.handleHeartbeat, tls.handleApplicationData, tls.handleHandshake, tls.handleHelloRequest) re-enter process() for each record. An attacker can exhaust the call stack and terminate the peer's Node.js process by sending many small TLS records in a single chunk, roughly 2,300 eight-byte records in under 20 KB on Node.js 24, since each record adds a stack frame rather than being handled in a loop. This affects any forge.tls connection in server or client mode, including those from wrapSocket, forge.http, and forge.xhr, needs no handshake because heartbeat records are processed first, and in a browser is confined to the attacked connection while a Node.js process crash drops every connection it serves.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Prototype Pollution in the client.setCookie function in lib/http.js. A malicious server can add or delete Object.prototype and Object properties across the entire JavaScript realm by returning a Set-Cookie header named __proto__ or constructor, because the forge.http cookie store keys a plain object by cookie name and path and tests membership with the in operator, and an empty cookie value routes to client.removeCookie to delete inherited properties. This is reached only when the application uses forge.http, or forge.xhr through the forge.all browser bundle, which require('node-forge') does not load, and the empty-value deletion path skips the secure-flag and domain checks, so it also works for plain http:// clients.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to NULL Pointer Dereference in the _readRecord function in lib/tls.js. An attacker can terminate the peer's Node.js process by sending a handshake message fragmented across records and then interleaving a record of another content type such as an alert, change_cipher_spec, application_data, or heartbeat, because the resulting fatal error sets c.record to null while _readRecord() continues and assigns c.record.ready = true, throwing an uncaught TypeError out of process(). This affects any forge.tls connection in server or client mode, including those from wrapSocket, forge.http, and forge.xhr, and the crash lands when process() is driven from a Node.js socket data handler as in the documented usage.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the asn1.oidToDer function in lib/asn1.js. An attacker can make the encoder emit DER for a different, trusted OID than the string the application validated, by supplying an OID whose first two arcs are out of range, because oidToDer computes 40 * arc1 + arc2 and writes the result with putByte(), which keeps only the low 16 bits, so 0.42.840.113549.1.1.1 encodes to the DER for 1.2.840.113549.1.1.1 (rsaEncryption). This affects only applications that accept untrusted OID strings, validate them as strings, and then encode them with node-forge into structures such as certificates or CSRs, while decoding DER is unaffected.

Note: This is a bypass of the fix for the vulnerability described in CVE-2025-66030.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) in the pki.verifyCertificateChain function in lib/x509.js. An attacker can permanently disable verification against an affected trusted CA by presenting a certificate whose issuer name matches a subject shared by two or more CAs in the store, because the function calls parents.shift() on the live array returned by caStore.getIssuer() (the store's internal caStore.certs[hash]), removing every candidate CA it examines, including the one that ultimately verifies the chain. Exploitation requires a long-lived CA store that holds two or more certificates with the same subject name and is reused across verifications, such as a forge.tls client sharing one caStore object across connections, a condition that mostly arises in private PKIs with re-keyed or renewed CAs that kept their name. The failure mode is availability only: subsequent valid chains under the drained CA are rejected, verification against other trusted CAs continues to work, and no invalid chain is ever accepted.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the pem.decode function in lib/pem.js. A remote attacker can block the Node.js event loop for seconds to minutes with an input of a few tens of kilobytes, because the message regex takes polynomial time on PEM text that contains no matching END line. This requires the application to pass untrusted PEM to a parsing entry point such as pki.certificateFromPem(), pki.privateKeyFromPem(), or pkcs7.messageFromPem(), as in a service that accepts uploaded certificates, keys, CSRs, or SAML metadata.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Infinite loop in the BigInteger.prototype.modInverse method in the bundled jsbn library (lib/jsbn.js). An attacker can spin the calling thread at 100% CPU and block the Node.js event loop by supplying a negative operand or negative modulus to modInverse, whose binary extended Euclidean algorithm is defined only for positive integers and so never reaches its loop exit condition. This is reachable only when an application passes an untrusted RSA public exponent to forge.pki.rsa.generateKeyPair(), createKeyPairGenerationState(), or stepKeyPairGenerationState() (any exponent other than 3 or 65537 takes the pure-JavaScript path), or calls modInverse() directly on negative values derived from untrusted input, while data parsed by node-forge such as DER, PEM, JWK, PKCS#12, X.509, and TLS is read as unsigned and cannot trigger it.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-33891.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to NULL Pointer Dereference in the tls.handleServerHelloDone function in lib/tls.js. A malicious TLS server, or an on-path attacker who strips the server's Certificate message, can terminate the client's Node.js process by completing a handshake with no certificate, because the missing-certificate guard tests the unused c.serverCertificate property while tls.createClientKeyExchange reads c.session.serverCertificate.publicKey and throws an uncaught TypeError. This affects only applications that use the forge TLS client (forge.tls.createConnection with server: false) and drive it from a socket data handler, and the exception leaves connection.process() without invoking the verify or error callbacks.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in rsa.js, whose DigestInfo validation checks the outer element count (obj.value.length !== 2) but never verifies the element count of the inner DigestAlgorithm SEQUENCE, so the ASN.1 parser accepts extra children that are ignored during digest extraction. An attacker can forge a signature that verifies as valid for an arbitrary message, without the private key, by fixing the target digest at the block boundaries and filling roughly 314 garbage bytes inside the DigestAlgorithm structure to absorb the mathematical residue. This only affects verification against RSA keys with a low public exponent such as e=3, and although _parseAllDigestBytes defaults to true and rejects trailing garbage, it does not detect this interior padding.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-33894 and, as of this publication, has not been acknowledged by project maintainers.

Upgrade node-forge to version 1.4.1 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in ASN.1 structures during RSA signature verification. An attacker can bypass signature verification and inject forged signatures by crafting ASN.1 data with extra fields or insufficient padding, allowing unauthorized actions or data integrity violations.

Note:

This is only exploitable if the default verification scheme (RSASSA-PKCS1-v1_5) is used with the _parseAllDigestBytes: true setting (which is the default).

Upgrade node-forge to version 1.4.0 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Certificate Validation in the verifyCertificateChain function. An attacker can gain unauthorized certificate authority capabilities by presenting a certificate chain where an intermediate certificate lacks both basicConstraints and keyUsage extensions, allowing the attacker to sign certificates for arbitrary domains and have them accepted as valid.

Upgrade node-forge to version 1.4.0 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Infinite loop via the modInverse function. An attacker can cause the application to hang indefinitely and consume excessive CPU resources by supplying a zero value as input, resulting in an infinite loop.

Upgrade node-forge to version 1.4.0 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the ed25519.verify function. An attacker can bypass authentication and authorization logic by submitting forged non-canonical signatures where the scalar S is not properly validated, allowing acceptance of signatures that should be rejected according to the specification.

Upgrade node-forge to version 1.4.0 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the fromDer function in asn1.js, which lacks recursion depth. An attacker can cause stack exhaustion and disrupt service availability by submitting specially crafted, deeply nested DER-encoded ASN.1 data.

Upgrade node-forge to version 1.3.2 or higher.

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the derToOid function in the asn1.js file, which decodes ASN.1 structures containing OIDs with oversized arcs. An attacker can bypass security decisions based on OID validation by crafting malicious ASN.1 data that exploits 32-bit bitwise truncation.

Upgrade node-forge to version 1.3.2 or higher.