DigitalBazaar Forge up to 1.4.2 forge.http lib/http.js trimString infinite loop

Summaryinfo

A vulnerability was found in DigitalBazaar Forge up to 1.4.2 and classified as problematic. This affects the function trimString of the file lib/http.js of the component forge.http. Executing a manipulation can lead to infinite loop. This vulnerability is registered as CVE-2026-125333. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in DigitalBazaar Forge up to 1.4.2 and classified as problematic. This vulnerability affects the function trimString of the file lib/http.js of the component forge.http. The manipulation with an unknown input leads to a infinite loop vulnerability. The CWE definition for the vulnerability is CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. As an impact it is known to affect availability. CVE summarizes:

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take quadratic time. A malicious server or on-path attacker can supply a long whitespace run followed by a non-whitespace character in a response header, causing response.readHeader() or response.getCookies() to repeatedly scan the input and block the Node.js event loop or browser tab for minutes. Applications are affected only when they use forge.http with a socket pool to communicate with an untrusted server; forge.http is not loaded by require('node-forge'), and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-125333 since 11/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.4.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• DigitalBazaar

Name

• Forge

Version

• 1.4.0
• 1.4.1
• 1.4.2

Website

• Product: https://github.com/digitalbazaar/forge/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion