Is node-forge 0.1 vulnerable?

npm · 14 releases from 0.1.2 to 0.1.15 · latest node-forge is 1.4.2 · checked 2 Nov 2026

Yes: 27 known advisories

Yes. node-forge 0.1.15, the last 0.1 release, is affected by 27 known security advisories (15 high, 6 medium, 6 low), including CVE-2026-118779, CVE-2026-118782, CVE-2026-119188. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting node-forge 0.1.15

  • LowCVE-2026-118775GHSA-4642-5mcj-2rqw30 Oct 2026

    Forge: ASN.1 OID first arc truncation in asn1.oidToDer

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • MediumCVE-2026-118777GHSA-6wvx-3r32-xmcg30 Oct 2026

    Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • MediumCVE-2026-118778GHSA-525v-9gp9-w22h30 Oct 2026

    Forge: TLS client crash when the server sends no certificate

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-118779GHSA-7wch-p9px-956x30 Oct 2026

    Forge: Regular expression denial of service in PEM decoding (pem.decode)

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • LowCVE-2026-118781GHSA-h6cr-wjv9-3cpp30 Oct 2026

    Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • LowCVE-2026-118780GHSA-4487-j8r4-4g2f30 Oct 2026

    Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • MediumCVE-2026-119186GHSA-5cwg-6vw7-rj6p30 Oct 2026

    Forge: AES-GCM authentication bypass via unvalidated tagLength option

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-118782GHSA-jc66-7q78-782g30 Oct 2026

    Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-119188GHSA-8hrf-8g6f-7xwp30 Oct 2026

    Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-119187GHSA-hqq3-7jhf-c5jx30 Oct 2026

    Forge: Denial of service in TLS record processing via call stack exhaustion

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-119190GHSA-5x38-2vff-x55p30 Oct 2026

    Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-33894GHSA-86w9-cpqp-85rv3 Sept 2026

    node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

    Affected
    <=1.4.0
    Fixed in
    No fix released
  • HighCVE-2026-33896GHSA-2328-f5f3-gj2526 Mar 2026

    Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

    Affected
    <1.4.0
    Fixed in
    1.4.0
  • HighCVE-2026-33895GHSA-q67f-28xg-22rw26 Mar 2026

    Forge has signature forgery in Ed25519 due to missing S > L check

    Affected
    <1.4.0
    Fixed in
    1.4.0
  • HighCVE-2026-33894GHSA-ppp5-5v6c-4jwp26 Mar 2026

    Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

    Affected
    <1.4.0
    Fixed in
    1.4.0
  • HighCVE-2026-33891GHSA-5m6q-g25r-mvwx26 Mar 2026

    Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

    Affected
    <1.4.0
    Fixed in
    1.4.0
  • HighCVE-2025-66031GHSA-554w-wpv2-vw2726 Nov 2025

    node-forge has ASN.1 Unbounded Recursion

    Affected
    <1.3.2
    Fixed in
    1.3.2
  • MediumCVE-2025-66030GHSA-65ch-62r8-g69g26 Nov 2025

    node-forge is vulnerable to ASN.1 OID Integer Truncation

    Affected
    <1.3.2
    Fixed in
    1.3.2
  • HighCVE-2025-12816GHSA-5gfm-wpxj-wjgq26 Nov 2025

    node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

    Affected
    <1.3.2
    Fixed in
    1.3.2
  • MediumCVE-2022-24773GHSA-2r2c-g63r-vccr18 Mar 2022

    Improper Verification of Cryptographic Signature in `node-forge`

    Affected
    <1.3.0
    Fixed in
    1.3.0
  • HighCVE-2022-24772GHSA-x4jg-mjrx-434g18 Mar 2022

    Improper Verification of Cryptographic Signature in node-forge

    Affected
    <1.3.0
    Fixed in
    1.3.0
  • HighCVE-2022-24771GHSA-cfm4-qjh2-476518 Mar 2022

    Improper Verification of Cryptographic Signature in node-forge

    Affected
    <1.3.0
    Fixed in
    1.3.0
  • MediumCVE-2022-0122GHSA-8fr3-hfg3-gpgp21 Jan 2022

    Open Redirect in node-forge

    Affected
    <1.0.0
    Fixed in
    1.0.0
  • LowGHSA-5rrq-pxf6-6jx58 Jan 2022

    Prototype Pollution in node-forge debug API.

    Affected
    <1.0.0
    Fixed in
    1.0.0
  • LowGHSA-wxgw-qj99-44c28 Jan 2022

    Prototype Pollution in node-forge util.setPath API

    Affected
    <0.10.0
    Fixed in
    0.10.0
  • LowGHSA-gf8q-jrpm-jvxq8 Jan 2022

    URL parsing in node-forge could lead to undesired behavior.

    Affected
    <1.0.0
    Fixed in
    1.0.0
  • HighCVE-2020-7720GHSA-92xj-mqp7-vmcj14 Sept 2020

    Prototype Pollution in node-forge

    Affected
    <0.10.0
    Fixed in
    0.10.0

Which of your client projects are still on node-forge 0.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact node-forge version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other node-forge versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.