7.5 High

CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
forge 1.4	earliest → < 1.4.1	1.4.1

References

github.com github.com
github.com github.com
github.com github.com
github.com github.com

Timeline

Published October 29, 2026
Last modified November 4, 2026

The 25 CVEs of forge →

CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.4 High CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 5.9 Medium CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.5 High CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion 7.5 High

Track this CVE