CVE-2026-118775

MediumCVSS 5.3/10Last modified Nov 4, 2026

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
digitalbazaar	forge	< 1.4.1

References

https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1ePatch
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1Release Notes
https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqwExploit, Mitigation, Vendor Advisory
https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqwExploit, Mitigation, Vendor Advisory

Timeline

Published: Oct 29, 2026
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1187765.3Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa CVE-2026-1187776.5Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client s CVE-2026-1187785.9Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa CVE-2026-1187797.5Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa CVE-2026-118786.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Manager allows Cross-S CVE-2026-1187803.7Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa CVE-2026-1187815.3Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa CVE-2026-1187827.5Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a P CVE-2026-1187836.8The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting CVE-2026-1187846.4The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a comb CVE-2026-1187856.7Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples), affecti CVE-2026-1187866.8Improper input validation in non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_ex