Node-Forge (< 1.4.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/node-forge--1.4.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 21:10:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgnode-forge: Certificate validation bypass via deprecated extensions (CVE-2026-119190)https://feed.craftedsignal.io/briefs/2026-10-node-forge-cert-bypass/Thu, 29 Oct 2026 21:10:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-node-forge-cert-bypass/Prior to version 1.4.1, node-forge incorrectly parses deprecated certificate extensions, potentially allowing a certificate to be accepted as a CA and enabling impersonation.<p>node-forge versions prior to 1.4.1 parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, with pki.verifyCertificateChain() prioritizing the first extension encountered. If a trusted CA issues a certificate containing these attacker-supplied extensions, the certificate may be accepted as a CA. This allows for server or client impersonation. If the CA includes a keyUsage extension without keyCertSign, the chain is rejected. This issue is addressed in version 1.4.1.</p> highadvisoryDigital Bazaar node-forge: ReDoS in pem.decode() (CVE-2026-118779)https://feed.craftedsignal.io/briefs/2026-10-node-forge-redos/Thu, 29 Oct 2026 20:40:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-node-forge-redos/Digital Bazaar node-forge versions prior to 1.4.1 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the pem.decode() function, allowing unauthenticated attackers to cause high CPU usage via malformed PEM input.The node-forge library, a native JavaScript implementation of TLS, contains a vulnerability in its pem.decode() function within lib/pem.js. The library uses polynomial-time regular expressions to process PEM input, including the search for matching END lines and the parsing of encapsulated headers. An unauthenticated attacker can supply crafted, malformed PEM input to any high-level parser relying on this function, triggering catastrophic backtracking that leads to excessive CPU consumption and denial of service. This vulnerability is identified as CVE-2026-118779.

Impact

Successful exploitation results in high CPU utilization, potentially leading to a denial-of-service condition for applications relying on the node-forge library to process user-supplied PEM files or certificates.

Recommendation

  • Upgrade the node-forge library to version 1.4.1 or later immediately.
  • Inventory applications within the environment that utilize the node-forge library for certificate or PEM parsing.
  • Review input validation controls for services that ingest PEM-encoded data to ensure length and complexity constraints are enforced before processing by the library.
]]>highadvisory