Digitalbazaar Forge up to 1.4.0 PKCS12 pki.pbe.generatePkcs12Key integrity check

Summaryinfo

A vulnerability labeled as problematic has been found in Digitalbazaar Forge up to 1.4.0. The impacted element is the function pki.pbe.generatePkcs12Key of the component PKCS12 Handler. Such manipulation leads to integrity check. This vulnerability is uniquely identified as CVE-2026-118782. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Digitalbazaar Forge up to 1.4.0. It has been rated as problematic. Affected by this issue is the function pki.pbe.generatePkcs12Key of the component PKCS12 Handler. The manipulation with an unknown input leads to a integrity check vulnerability. Using CWE to declare the problem leads to CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. Impacted is integrity. CVE summarizes:

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-118782 since 10/28/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.4.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Digitalbazaar

Name

• Forge

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

Website

• Product: https://github.com/digitalbazaar/forge/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion