node-forge package vulnerabilities
Advisories affecting the node-forge package. A list cannot tell you whether your installed version is affected — the dependency check can.
11 vulnerabilities tracked.
Check which version you are running → — this page lists advisories for the package; only a version check can tell you whether you are affected.
- 7.5 Forge: Regular expression denial of service in PEM decoding (pem.decode)
- 7.5 Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
- 7.5 Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
- 7.5 Forge: Denial of service in TLS record processing via call stack exhaustion
- 7.4 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
- 5.9 Forge: TLS client crash when the server sends no certificate
- 5.9 Forge: AES-GCM authentication bypass via unvalidated tagLength option
- 4.8 Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
- 3.7 Forge: ASN.1 OID first arc truncation in asn1.oidToDer
- 3.7 Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
- 2.9 Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that node-forge is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other packages tracked here
filelock github.com/labstack/echo/v5 github.com/labstack/echo/v4 vllm undici virtualenv pypdf @highcharts/dashboards adminneo-org/adminneo authlib GitPython highcharts seroval @highcharts/grid-pro org.mariadb.jdbc:mariadb-java-client zip org.keycloak:keycloak-services onnx pyasn1 phpoffice/phpspreadsheet better-auth mlflow rustls crass