CVE-2026-119191 in Forge
Summary
by MITRE • 10/29/2026
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The Forge library, also known as node-forge, serves as a native implementation of Transport Layer Security protocols within the JavaScript ecosystem, enabling developers to handle cryptographic operations such as certificate parsing and TLS handshake management directly in Node.js or browser environments. A critical flaw was identified in versions prior to 1.4.1 regarding how the library processes ASN.1 encoded data, specifically when handling BIT STRING values that contain nested structures. The vulnerability stems from an inconsistency in the application of depth limits during the decoding process. While the library is designed to prevent excessive recursion through a maxDepth parameter intended to limit the nesting level of parsed elements, this safeguard was not consistently enforced for ASN.1 structures embedded within BIT STRING fields.
Technically, when asn1.fromDer() processes input containing nested BIT STRINGs, it fails to decrement or check the remaining depth allowance against these inner structures. Consequently, an attacker can craft a malicious DER-encoded payload with deeply nested BIT STRING elements that bypasses the intended recursion limits. As the parser recursively traverses this structure without proper boundary checks, it retains copies of data at each nesting level rather than discarding intermediate states appropriately. This behavior leads to quadratic memory consumption and excessive CPU usage as the system attempts to process an unbounded depth of recursive calls. The flaw effectively allows a Denial of Service condition where a relatively small but deeply nested input can exhaust server resources, potentially crashing the application or degrading performance for other users sharing the same environment.
This vulnerability aligns with CWE-787: Out-of-bounds Write and CWE-675: Operations on Data Uncontrolled by Natural Maximal Limits, as it involves improper enforcement of resource limits leading to excessive consumption. From an ATT&CK perspective, this falls under T1499: Endpoint Denial of Service, specifically reflecting techniques that exploit software vulnerabilities to cause service disruption through resource exhaustion rather than direct system compromise. The impact is primarily availability-related, affecting the stability and responsiveness of services relying on node-forge for cryptographic parsing tasks such as X.509 certificate validation or PKCS#12 file processing.
To mitigate this risk, organizations must upgrade immediately to version 1.4.1 or later, where the developers have corrected the logic to ensure that depth limits are consistently applied across all ASN.1 decoding paths, including those within BIT STRINGs. Additionally, implementing input validation and size constraints on incoming cryptographic payloads can provide an additional layer of defense against malformed data. Monitoring for unusual spikes in CPU usage or memory consumption during certificate parsing operations may also help detect attempted exploitation attempts before they cause significant service disruption.