3.7 Low

CVE-2026-118780 Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: High
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Affected products and versions

Product	Affected versions	Fixed in
forge 1.4	earliest → < 1.4.1	1.4.1

References

github.com github.com
github.com github.com
github.com github.com

Timeline

Published October 29, 2026
Last modified November 4, 2026

The 25 CVEs of forge →

CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer 7.5 High CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.4 High CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 5.9 Medium CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.5 High

Track this CVE