Digitalbazaar Forge up to 1.4.0 AES-GCM forge.cipher.createDecipher tagLength data authenticity

Summaryinfo

A vulnerability has been found in Digitalbazaar Forge up to 1.4.0 and classified as problematic. This vulnerability affects the function forge.cipher.createDecipher of the component AES-GCM. Performing a manipulation of the argument tagLength results in data authenticity. This vulnerability is cataloged as CVE-2026-119186. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Digitalbazaar Forge up to 1.4.0. It has been classified as problematic. This affects the function forge.cipher.createDecipher of the component AES-GCM. The manipulation of the argument tagLength with an unknown input leads to a data authenticity vulnerability. CWE is classifying the issue as CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. This is going to have an impact on integrity. The summary by CVE is:

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-119186 since 10/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.4.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Digitalbazaar

Name

• Forge

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

Website

• Product: https://github.com/digitalbazaar/forge/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion