CVE-2026-118780

LowCVSS 3.7/10Last modified Nov 10, 2026

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-295 CWE-471

Affected software

Vendor	Product	Versions
digitalbazaar	forge	< 1.4.1

References

https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0Patch
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1Release Notes
https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2fExploit, Mitigation, Vendor Advisory
https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2fExploit, Mitigation, Vendor Advisory

Timeline

Published: Oct 29, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1187815.3Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa CVE-2026-1187827.5Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a P CVE-2026-1187836.8The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting CVE-2026-1187846.4The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a comb CVE-2026-1187856.7Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples), affecti CVE-2026-1187866.8Improper input validation in non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_ex CVE-2026-118798.5MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a te CVE-2026-1187907.2Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unaut CVE-2026-1187917.2The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to CVE-2026-1187926.1Default credentials permit access through AcuXDBC.CVE-2026-1187955.9Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with da CVE-2026-1187984.4Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are