DailyCVE@dailycve
🔴 Node-forge, ReDoS Vulnerability, #CVE-2026-118779 (Critical) -DC-Oct2026-4025 https://dailycve.com/node-forge-redos-vulnerability-cve-2026-118779-critical-dc-oct2026-4025/
0000029
249 followersView on X
CVE-2026-118779
LOWCVSS 7.5 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x
Weakness type (CWE)
CWE-400CWE-1333
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day