Digitalbazaar Forge vulnerabilities

• digitalbazaar forge Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer CVE-2026-119191 7.5 HighOctober 29, 2026
• digitalbazaar forge Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 CVE-2026-119190 Fix available 7.4 HighOctober 29, 2026
• digitalbazaar forge Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage CVE-2026-119189 5.9 MediumOctober 29, 2026
• digitalbazaar forge Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message CVE-2026-119188 Fix available 7.5 HighOctober 29, 2026
• digitalbazaar forge Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) CVE-2026-118781 Fix available 2.9 LowOctober 29, 2026
• digitalbazaar forge Forge: TLS client crash when the server sends no certificate CVE-2026-118778 Fix available 5.9 MediumOctober 29, 2026
• digitalbazaar forge Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie CVE-2026-118777 Fix available 4.8 MediumOctober 29, 2026
• digitalbazaar forge Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption CVE-2026-118776 Public exploit 3.7 LowOctober 29, 2026
• digitalbazaar forge Forge: ASN.1 OID first arc truncation in asn1.oidToDer CVE-2026-118775 Fix available 3.7 LowOctober 29, 2026
• digitalbazaar forge Forge: Certificate signature verified with the issuer's RSA signature scheme CVE-2026-118774 3.7 LowOctober 29, 2026
• digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +16 more +18 more Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVE-2026-33896 Fix available 7.4 HighMarch 26, 2026
• digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +16 more +18 more Forge has signature forgery in Ed25519 due to missing S > L check CVE-2026-33895 Fix available 7.5 HighMarch 26, 2026
• digitalbazaar forge node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding CVE-2026-85393 Fix available 8.7 HighMarch 26, 2026
• digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +22 more +24 more Forge has signature forgery in RSA-PKCS due to ASN.1 extra field CVE-2026-33894 Fix available 7.5 HighMarch 26, 2026
• digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +17 more +19 more Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input CVE-2026-33891 Fix available 7.5 HighMarch 26, 2026
• digitalbazaar forge node-forge ASN.1 Unbounded Recursion CVE-2025-66031 Fix available 8.7 HighNovember 26, 2025
• digital bazaar forge, node-forge +1 more CVE-2025-12816 CVE-2025-12816 Fix available 8.6 HighNovember 25, 2025
• digitalbazaar forge Improper Verification of Cryptographic Signature in `node-forge` CVE-2022-24772 Fix available 7.5 HighMarch 18, 2022
• digitalbazaar forge Improper Verification of Cryptographic Signature in node-forge CVE-2022-24771 Fix available 7.5 HighMarch 18, 2022
• digitalbazaar forge node-forge ASN.1 OID Integer Truncation CVE-2025-66030 Fix available 6.3 MediumJanuary 8, 2022
• digitalbazaar forge Improper Verification of Cryptographic Signature in `node-forge` CVE-2022-24773 Fix available 5.3 MediumJanuary 8, 2022
• digitalbazaar forge Forge: Denial of service in TLS record processing via call stack exhaustion CVE-2026-119187 Fix available 7.5 HighJanuary 8, 2022
• digitalbazaar forge Forge: AES-GCM authentication bypass via unvalidated tagLength option CVE-2026-119186 Fix available 5.9 MediumJanuary 8, 2022
• digitalbazaar forge Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count CVE-2026-118782 Fix available 7.5 HighJanuary 8, 2022
• digitalbazaar forge Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store CVE-2026-118780 Fix available 3.7 LowJanuary 8, 2022
• digitalbazaar forge Forge: Regular expression denial of service in PEM decoding (pem.decode) CVE-2026-118779 Fix available 7.5 HighJanuary 8, 2022
• digitalbazaar digitalbazaar/forge, forge +1 more Open Redirect in digitalbazaar/forge CVE-2022-0122 Fix available 5.3 MediumJanuary 6, 2022
• digital bazaar node-forge, digitalbazaar forge +1 more Prototype Pollution CVE-2020-7720 Fix available 9.8 CriticalSeptember 1, 2020