CVE-2026-118782 in Forge
Summary
by MITRE • 10/29/2026
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in the node-forge library, a native JavaScript implementation of Transport Layer Security and various cryptographic standards, represents a critical failure in input validation for PKCS#12 file processing. Prior to version 1.4.1, the library failed to enforce minimum thresholds for two specific parameters within PKCS#12 structures: the Message Authentication Code iteration count and the password-based encryption iteration count. These values are fundamental components of cryptographic key derivation functions designed to increase computational cost and resist brute-force attacks by requiring multiple hashing iterations. By accepting zero or negative integer inputs, node-forge deviated from established security practices defined in RFC 7292, which mandates that these parameters must be positive integers to ensure the integrity and confidentiality mechanisms function as intended.
The technical flaw manifests primarily within the pki.pbe.generatePkcs12Key() function when it processes malformed PKCS#12 data containing invalid iteration counts. Instead of rejecting such inputs or applying a default secure minimum, the implementation returned a constant cryptographic key that was independent of both the provided password and the salt value embedded in the file. This behavior effectively neutralized the purpose of using salts and passwords for key derivation, as the resulting encryption keys became predictable and static regardless of user input. Consequently, any crafted PKCS#12 archive processed by forge.pkcs12.pkcs12FromAsn1() could bypass password-based integrity checks because the attacker-controlled iteration count forced a deterministic output that matched expected decryption parameters without requiring knowledge of the actual secret passphrase.
This weakness extends beyond simple MAC verification to affect data confidentiality in specific legacy encryption algorithms supported by node-forge, namely pbeWithSHAAnd3-KeyTripleDES-CBC and pbewithSHAAnd40BitRC2-CBC. These older cipher suites were particularly susceptible because they relied heavily on the strength of their key derivation processes for security assurance. The vulnerability impacted shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY structures when processed independently via forge.pki.decryptPrivateKeyInfo(). In these scenarios, an attacker could construct malicious files that decrypt successfully using a known or predictable key derived from the invalid iteration count, thereby exposing sensitive private keys and certificate data to unauthorized access. It is important to note that modern PBES2 with PBKDF2 encrypted content remains unaffected by this specific flaw due to its more robust implementation of parameter validation and derivation logic.
From an operational perspective, this vulnerability poses a severe risk in environments where node-forge is used to parse or generate PKCS#12 bundles for authentication, code signing, or secure storage purposes. An attacker could distribute maliciously crafted PKCS#12 files that appear valid but contain hidden payloads or exfiltrated data protected by weak encryption keys derived from the vulnerability. If a victim application automatically trusts and decrypts such files without explicit user verification of password integrity, it may lead to credential theft, unauthorized access to secure systems, or compromise of digital signatures. The impact is particularly acute in web applications that handle certificate uploads or manage client certificates for mutual TLS authentication, as these workflows often rely on the library's ability to validate and decrypt incoming PKCS#12 data securely.
The issue aligns with CWE-798: Use of Hard-coded Credentials, specifically regarding the generation of predictable cryptographic keys based on invalid inputs rather than true secrets, and CWE-613: Insufficient Session Expiration or CWE-related input validation failures in cryptographic contexts where parameter bounds are not enforced. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with Tactic 0002 Execution and Tactic 0004 Privilege Escalation by allowing attackers to bypass authentication controls through crafted inputs that exploit implementation weaknesses rather than brute-forcing passwords directly. The exploitation vector is typically classified under Input Validation failures where the system fails to reject malformed data structures, leading to unintended cryptographic behavior.
Mitigation for this vulnerability requires immediate upgrading of node-forge to version 1.4.1 or later, which corrects the input validation logic to enforce positive integer constraints on iteration counts and MAC parameters. Organizations relying on older versions must implement strict input sanitization at the application layer before passing PKCS#12 data to the library, ensuring that all cryptographic parameters meet minimum security standards defined by relevant RFCs. Additionally, developers should audit codebases for direct usage of forge.pki.decryptPrivateKeyInfo() or forge.pkcs12.pkcs12FromAsn1() with untrusted inputs and consider migrating to more modern key derivation functions like PBKDF2 or Argon2 where possible, as these provide stronger resistance against brute-force attacks even if parameter validation is imperfect. Regular security assessments of cryptographic dependencies are essential to identify similar implementation flaws in other libraries that may not have received timely patches for such fundamental logic errors.