CVE-2026-118779 in Forge
Summary
by MITRE • 10/29/2026
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified as CVE-2023-46749 affects node-forge, also known simply as Forge, which serves as a native implementation of Transport Layer Security protocols written entirely in JavaScript. This library is widely utilized within the Node.js ecosystem to handle cryptographic operations, including TLS handshakes and certificate parsing. The core technical flaw resides specifically within the pem.decode function located in the lib/pem.js module. During version 1.4.0 and earlier releases, this implementation failed to properly validate input boundaries when processing PEM-encoded data structures. Specifically, the parser relied on polynomial-time regular expressions to locate matching END lines and parse encapsulated headers without adequate safeguards against malformed or excessively long inputs that lacked proper termination markers.
From a technical perspective, the issue stems from how the regular expression engine processes strings containing maliciously crafted payloads. When an attacker supplies PEM input with missing end delimiters or artificially extended lengths, the regex backtracking behavior can trigger catastrophic exponential time complexity rather than linear processing. This phenomenon allows an unauthenticated actor to force the JavaScript event loop into a state of high CPU utilization. Because node-forge is often integrated directly into server-side applications handling network traffic, this resource exhaustion translates directly into a denial of service condition for downstream services and users relying on those systems.
The operational impact of this vulnerability is significant due to its unauthenticated nature. An attacker does not need valid credentials or prior access privileges to exploit the flaw; they merely need the ability to supply PEM-formatted data to any high-level parser that utilizes node-forge under the hood. This could include APIs accepting certificate uploads, key exchanges, or encrypted message payloads. The resulting denial of service disrupts availability, potentially causing application crashes, server timeouts, and degradation of service for legitimate users. In cloud-native environments where resources are auto-scaled based on load metrics, such attacks can also lead to increased infrastructure costs due to unnecessary scaling events triggered by the artificial CPU spikes.
This vulnerability aligns with CWE-400, which classifies uncontrolled resource consumption leading to denial of service conditions. Furthermore, it maps to MITRE ATT&CK technique T1496, representing Resource Hijacking where attackers consume computational resources to degrade performance or availability for other users. The exploitation vector is categorized under Network Access since the attack can be conducted remotely over standard network connections without requiring local system access.
Mitigation strategies primarily involve upgrading node-forge to version 1.4.1 or later, which includes patches that enforce stricter input validation and prevent the regex engine from entering inefficient backtracking states with malformed inputs. Organizations relying on this library should audit their dependency trees to ensure no legacy versions remain in production environments. Additionally, implementing rate limiting at the network perimeter can help mitigate the impact of such attacks by restricting the volume of PEM data processed per unit time. Input validation layers that sanitize or reject excessively long strings before they reach cryptographic parsers provide an additional defense-in-depth measure against this class of regular expression denial of service vulnerabilities.