Digital Bazaar node-forge: ASN.1 resource exhaustion (CVE-2026-119191)

The asn1.fromDer() function in node-forge (versions <= 1.4.0) contains two vulnerabilities that allow for denial of service (DoS) via resource exhaustion. First, recursion depth limits (intended to fix CVE-2025-66031) are not enforced when decoding nested BIT STRING contents. Second, each nested BIT STRING triggers a deep copy of decoded contents, resulting in quadratic memory growth relative to nesting depth.

An unauthenticated attacker can supply small (e.g., 20 KB to 200 KB) crafted DER or PEM files to any application using node-forge for PKI, TLS, or certificate parsing (such as pki.certificateFromPem or pki.publicKeyFromPem), causing excessive CPU usage or fatal memory exhaustion that cannot be caught by the application.

Impact

Successful exploitation results in a crash of the Node.js process. The attack does not allow for unauthorized access, data exfiltration, or remote code execution; it is strictly a denial of service impact. Observed inputs of ~25 KB have triggered fatal out-of-memory errors on Node.js processes with 512 MB heaps.

Recommendation

• Upgrade node-forge to version 1.4.1 or later.
• Audit applications utilizing node-forge to identify entry points for certificate or PEM/DER parsing (e.g., TLS clients, PKCS loaders).
• If upgrading is not immediately possible, callers of forge.asn1.fromDer() can pass the option {decodeBitStrings: false} to mitigate the vulnerability for custom parsing logic, though this alters the resulting object structure.