node-forge vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-118775Lownode-forge: Forge: ASN.1 OID first arc truncation in asn1.oidToDerCVE-2026-118777Mediumnode-forge: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieCVE-2026-118778Mediumnode-forge: Forge: TLS client crash when the server sends no certificateCVE-2026-118779Highnode-forge: Forge: Regular expression denial of service in PEM decoding (pem.decode)CVE-2026-118781Lownode-forge: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)CVE-2026-118780Lownode-forge: Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeCVE-2026-119186Mediumnode-forge: Forge: AES-GCM authentication bypass via unvalidated tagLength optionCVE-2026-118782Highnode-forge: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countCVE-2026-119188Highnode-forge: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageCVE-2026-119187Highnode-forge: Forge: Denial of service in TLS record processing via call stack exhaustionCVE-2026-119190Highnode-forge: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13CVE-2026-85393Highnode-forge: node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elementsCVE-2026-33896Highnode-forge: Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)CVE-2026-33895Highnode-forge: Forge has signature forgery in Ed25519 due to missing S > L checkCVE-2026-33894Highnode-forge: Forge has signature forgery in RSA-PKCS due to ASN.1 extra field CVE-2026-33891Highnode-forge: Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputCVE-2025-66031Highnode-forge: node-forge has ASN.1 Unbounded RecursionCVE-2025-66030Mediumnode-forge: node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-12816Highnode-forge: node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator DesynchronizationCVE-2022-24773Mediumnode-forge: Improper Verification of Cryptographic Signature in `node-forge`CVE-2022-24772Highnode-forge: Improper Verification of Cryptographic Signature in node-forgeCVE-2022-24771Highnode-forge: Improper Verification of Cryptographic Signature in node-forgeCVE-2022-0122Mediumnode-forge: Open Redirect in node-forgeGHSA-5RRQ-PXF6-6JX5Lownode-forge: Prototype Pollution in node-forge debug API.GHSA-WXGW-QJ99-44C2Lownode-forge: Prototype Pollution in node-forge util.setPath API

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo