DailyCVE@dailycve
🔵 Node-forge, Denial of Service, #CVE-2026-118781 (Low) -DC-Oct2026-4037 https://dailycve.com/node-forge-denial-of-service-cve-2026-118781-low-dc-oct2026-4037/
0000030
249 followersView on X
CVE-2026-118781
LOWCVSS 2.9 · LOWSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-835
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day