{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/node-forge--1.4.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-119190"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["node-forge (\u003c 1.4.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003enode-forge versions prior to 1.4.1 parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, with pki.verifyCertificateChain() prioritizing the first extension encountered. If a trusted CA issues a certificate containing these attacker-supplied extensions, the certificate may be accepted as a CA. This allows for server or client impersonation. If the CA includes a keyUsage extension without keyCertSign, the chain is rejected. This issue is addressed in version 1.4.1.\u003c/p\u003e\n","date_modified":"2026-10-29T21:10:37Z","date_published":"2026-10-29T21:10:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-node-forge-cert-bypass/","summary":"Prior to version 1.4.1, node-forge incorrectly parses deprecated certificate extensions, potentially allowing a certificate to be accepted as a CA and enabling impersonation.","title":"node-forge: Certificate validation bypass via deprecated extensions (CVE-2026-119190)","url":"https://feed.craftedsignal.io/briefs/2026-10-node-forge-cert-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:digitalbazaar:node-forge:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118779"},{"cvss":7.5,"id":"CVE-2026-118782"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["node-forge (\u003c 1.4.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Digital Bazaar"],"content_html":"\u003cp\u003eThe node-forge library, a native JavaScript implementation of TLS, contains a vulnerability in its \u003ccode\u003epem.decode()\u003c/code\u003e function within \u003ccode\u003elib/pem.js\u003c/code\u003e. The library uses polynomial-time regular expressions to process PEM input, including the search for matching END lines and the parsing of encapsulated headers. An unauthenticated attacker can supply crafted, malformed PEM input to any high-level parser relying on this function, triggering catastrophic backtracking that leads to excessive CPU consumption and denial of service. This vulnerability is identified as CVE-2026-118779.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in high CPU utilization, potentially leading to a denial-of-service condition for applications relying on the node-forge library to process user-supplied PEM files or certificates.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the node-forge library to version 1.4.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eInventory applications within the environment that utilize the node-forge library for certificate or PEM parsing.\u003c/li\u003e\n\u003cli\u003eReview input validation controls for services that ingest PEM-encoded data to ensure length and complexity constraints are enforced before processing by the library.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T20:40:53Z","date_published":"2026-10-29T20:40:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-node-forge-redos/","summary":"Digital Bazaar node-forge versions prior to 1.4.1 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the pem.decode() function, allowing unauthenticated attackers to cause high CPU usage via malformed PEM input.","title":"Digital Bazaar node-forge: ReDoS in pem.decode() (CVE-2026-118779)","url":"https://feed.craftedsignal.io/briefs/2026-10-node-forge-redos/"}],"language":"en","title":"CraftedSignal Threat Feed - Node-Forge (\u003c 1.4.1)","version":"https://jsonfeed.org/version/1.1"}