7.5
High
CVE-2026-33891 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| forge 1.4 | earliest → < 1.4.0 | 1.4.0 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Developer Hub 1.8 1776784286 | earliest → < 1776784286 | 1776784286 |
| Red Hat Developer Hub 1.9 1777903262 | earliest → < 1777903262 | 1777903262 |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published |
Show the 12 other branches Hide the 12 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Cryostat 4 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Cluster Observability Operator 1.5.0 1782839279 | earliest → < 1782839279 | 1782839279 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of forge
The 25 CVEs of forge →
CVE-2026-119191
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
High
CVE-2026-119190
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
7.4
High
CVE-2026-119189
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
5.9
Medium
CVE-2026-119188
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
7.5
High