3.7
Faible
CVE-2026-118775 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| forge 1.4 | premières → < 1.4.1 | 1.4.1 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de forge
Les 25 CVE de forge →
CVE-2026-119191
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
Élevée
CVE-2026-119190
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
7.4
Élevée
CVE-2026-119189
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
5.9
Moyenne
CVE-2026-119188
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
7.5
Élevée