Skip to content
Threat Feed
Subscribe

Tag

Node-Forge

2 briefs RSS
high advisory

Node-Forge Certificate Chain Verification Bypass due to basicConstraints Violation

Node-forge's certificate chain verification fails to enforce RFC 5280 basicConstraints, allowing leaf certificates without basicConstraints and keyUsage extensions to act as Certificate Authorities, leading to potential certificate forgery and man-in-the-middle attacks.

certificate-forgery man-in-the-middle node-forge basicConstraints
2r 3t
high advisory

Node-Forge Denial of Service via modInverse(0)

The node-forge library is vulnerable to a denial of service (DoS) due to an infinite loop in the BigInteger.modInverse() function when called with a zero value, leading to application unresponsiveness and high CPU usage.

node-forge denial-of-service javascript cryptography
3r 2t