CVE-2026-119186 in Forge
Summary
by MITRE • 10/29/2026
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The Forge library, also known as node-forge, serves as a native implementation of Transport Layer Security protocols within JavaScript environments, enabling developers to handle cryptographic operations such as encryption and decryption without relying on external system libraries. A critical security flaw was identified in versions prior to 1.4.1 regarding the handling of authenticated encryption with associated data (AEAD), specifically when using the Advanced Encryption Standard in Galois/Counter Mode AES-GCM. The vulnerability stems from an insufficient validation mechanism within the cipher decryption process, particularly inside the forge.cipher.createDecipher() function and its subsequent finish method. This flaw allows for a scenario where unauthenticated ciphertext can be accepted as valid, effectively bypassing integrity checks that are fundamental to secure communication protocols.
The technical root cause of this vulnerability lies in how the library processes the tagLength parameter during decryption operations. When an application derives the expected authentication tag length from received data or utilizes configuration values that resolve to zero or near-zero states, the internal logic fails to properly enforce the requirement for a valid cryptographic tag. In AES-GCM mode, every encrypted message includes an authentication tag generated by the encryption process, which must be verified during decryption to ensure the ciphertext has not been tampered with and originates from a legitimate source. If the specified or derived tagLength is zero, empty, or effectively nullified due to configuration errors, the decipher.finish() method incorrectly treats the absence of a valid tag as acceptable. Consequently, the calculated hash comparison logic fails because both the expected tag (derived from an invalid length) and the actual supplied tag are treated as empty strings, leading to a false positive match that accepts maliciously altered or forged data.
This flaw poses significant operational risks for applications relying on Forge for secure communications, particularly those where configuration parameters might be dynamically determined by external inputs rather than hardcoded constants. If an attacker can influence the source from which the tagLength is derived, they may craft payloads with empty or missing authentication tags that will pass validation checks. This effectively neutralizes the integrity protection provided by AES-GCM, allowing for potential data tampering, injection attacks, or protocol manipulation without detection. It is important to note that applications using default configurations are generally unaffected; specifically, those that omit the tagLength parameter and rely on the standard 128-bit default value, as well as those passing fixed valid tag lengths, maintain proper security boundaries because these values do not trigger the zero-length validation bypass logic.
From a classification perspective, this vulnerability aligns with CWE-345 Insufficient Verification of Data Authenticity, as the system fails to adequately verify that the received data matches what was originally sent. It also relates to CWE-20 Improper Input Validation, given that the library does not strictly validate the tagLength parameter against expected constraints before proceeding with decryption logic. In terms of adversary tactics, this flaw could be exploited within ATT&CK techniques related to Defense Evasion or Command and Control, where an attacker might manipulate encrypted channels to inject malicious commands or exfiltrate data without triggering integrity alerts. The lack of proper authentication verification undermines the core security guarantees provided by authenticated encryption modes.
To mitigate this vulnerability, organizations utilizing node-forge must upgrade immediately to version 1.4.1 or later, which includes patches that enforce strict validation on the tagLength parameter during decryption operations. Developers should audit their codebases for any dynamic derivation of cryptographic parameters from untrusted sources and ensure that authentication tags are always validated against non-zero expected lengths. Additionally, implementing defense-in-depth strategies such as explicit integrity checks at higher application layers can provide an additional safeguard if lower-level library vulnerabilities arise in the future. Regular security assessments and dependency updates remain essential practices to maintain robust protection against cryptographic implementation flaws.