node-forge vulnerabilities

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Registry
npm
Latest
1.4.0
License
(BSD-3-Clause OR GPL-2.0)
Source
github.com/digitalbazaar/forge (opens the source repository in a new tab)

16 known advisories

The latest version, 1.4.0, is affected by 1 of them.

Security advisories for node-forge

  • HighGHSA-86w9-cpqp-85rv3 Sept 2026

    node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

    Affected
    <=1.4.0
    Fixed in
    No fix released
  • HighGHSA-2328-f5f3-gj2526 Mar 2026

    Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

    Affected
    <1.4.0
    Fixed in
    1.4.0
  • HighGHSA-q67f-28xg-22rw26 Mar 2026

    Forge has signature forgery in Ed25519 due to missing S > L check

    Affected
    <1.4.0
    Fixed in
    1.4.0
  • HighGHSA-ppp5-5v6c-4jwp26 Mar 2026

    Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

    Affected
    <1.4.0
    Fixed in
    1.4.0
  • HighGHSA-5m6q-g25r-mvwx26 Mar 2026

    Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

    Affected
    <1.4.0
    Fixed in
    1.4.0
  • HighGHSA-554w-wpv2-vw2726 Nov 2025

    node-forge has ASN.1 Unbounded Recursion

    Affected
    <1.3.2
    Fixed in
    1.3.2
  • MediumGHSA-65ch-62r8-g69g26 Nov 2025

    node-forge is vulnerable to ASN.1 OID Integer Truncation

    Affected
    <1.3.2
    Fixed in
    1.3.2
  • HighGHSA-5gfm-wpxj-wjgq26 Nov 2025

    node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

    Affected
    <1.3.2
    Fixed in
    1.3.2
  • MediumGHSA-2r2c-g63r-vccr18 Mar 2022

    Improper Verification of Cryptographic Signature in `node-forge`

    Affected
    <1.3.0
    Fixed in
    1.3.0
  • HighGHSA-x4jg-mjrx-434g18 Mar 2022

    Improper Verification of Cryptographic Signature in node-forge

    Affected
    <1.3.0
    Fixed in
    1.3.0
  • HighGHSA-cfm4-qjh2-476518 Mar 2022

    Improper Verification of Cryptographic Signature in node-forge

    Affected
    <1.3.0
    Fixed in
    1.3.0
  • MediumGHSA-8fr3-hfg3-gpgp21 Jan 2022

    Open Redirect in node-forge

    Affected
    <1.0.0
    Fixed in
    1.0.0
  • LowGHSA-5rrq-pxf6-6jx58 Jan 2022

    Prototype Pollution in node-forge debug API.

    Affected
    <1.0.0
    Fixed in
    1.0.0
  • LowGHSA-wxgw-qj99-44c28 Jan 2022

    Prototype Pollution in node-forge util.setPath API

    Affected
    <0.10.0
    Fixed in
    0.10.0
  • LowGHSA-gf8q-jrpm-jvxq8 Jan 2022

    URL parsing in node-forge could lead to undesired behavior.

    Affected
    <1.0.0
    Fixed in
    1.0.0
  • HighGHSA-92xj-mqp7-vmcj14 Sept 2020

    Prototype Pollution in node-forge

    Affected
    <0.10.0
    Fixed in
    0.10.0

Which of your client projects still run an old node-forge?

NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other npm packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.