Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨High - node-forge ASN.1 BIT STRING Deep Nesting DoS (CVE-2026-119191) Forge (node-forge) asn1.fromDer() may decode ASN.1 embedded inside BIT STRING values without consistently enforcing the configured maxDepth. Crafted DER with deeply nested BIT STRINGs triggers excessive recursion, high CPU, and quadratic memory growth, causing DoS. 👉Affected: node-forge <= 1.4.0 | Upgrade to 1.4.1
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | digitalbazaar | forge | - | - | - |