Cpe:2.3:a:digitalbazaar:node-Forge:*:*:*:*:*:node.js:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3adigitalbazaarnode-forgenode.js/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 20:40:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDigital Bazaar node-forge: ReDoS in pem.decode() (CVE-2026-118779)https://feed.craftedsignal.io/briefs/2026-10-node-forge-redos/Thu, 29 Oct 2026 20:40:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-node-forge-redos/Digital Bazaar node-forge versions prior to 1.4.1 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the pem.decode() function, allowing unauthenticated attackers to cause high CPU usage via malformed PEM input.The node-forge library, a native JavaScript implementation of TLS, contains a vulnerability in its pem.decode() function within lib/pem.js. The library uses polynomial-time regular expressions to process PEM input, including the search for matching END lines and the parsing of encapsulated headers. An unauthenticated attacker can supply crafted, malformed PEM input to any high-level parser relying on this function, triggering catastrophic backtracking that leads to excessive CPU consumption and denial of service. This vulnerability is identified as CVE-2026-118779.

Impact

Successful exploitation results in high CPU utilization, potentially leading to a denial-of-service condition for applications relying on the node-forge library to process user-supplied PEM files or certificates.

Recommendation

  • Upgrade the node-forge library to version 1.4.1 or later immediately.
  • Inventory applications within the environment that utilize the node-forge library for certificate or PEM parsing.
  • Review input validation controls for services that ingest PEM-encoded data to ensure length and complexity constraints are enforced before processing by the library.
]]>highadvisory