Digital Bazaar node-forge: ReDoS in pem.decode() (CVE-2026-118779)

The node-forge library, a native JavaScript implementation of TLS, contains a vulnerability in its pem.decode() function within lib/pem.js. The library uses polynomial-time regular expressions to process PEM input, including the search for matching END lines and the parsing of encapsulated headers. An unauthenticated attacker can supply crafted, malformed PEM input to any high-level parser relying on this function, triggering catastrophic backtracking that leads to excessive CPU consumption and denial of service. This vulnerability is identified as CVE-2026-118779.

Impact

Successful exploitation results in high CPU utilization, potentially leading to a denial-of-service condition for applications relying on the node-forge library to process user-supplied PEM files or certificates.

Recommendation

• Upgrade the node-forge library to version 1.4.1 or later immediately.
• Inventory applications within the environment that utilize the node-forge library for certificate or PEM parsing.
• Review input validation controls for services that ingest PEM-encoded data to ensure length and complexity constraints are enforced before processing by the library.