Is node-forge 0.9 vulnerable?
npm · 3 releases from 0.9.0 to 0.9.2 · latest node-forge is 1.4.2 · checked 1 Nov 2026
Yes: 27 known advisories
Yes. node-forge 0.9.2, the last 0.9 release, is affected by 27 known security advisories (15 high, 6 medium, 6 low), including CVE-2026-118779, CVE-2026-118782, CVE-2026-119188. At least one has no fixed release yet.
Advisories affecting node-forge 0.9.2
Forge: ASN.1 OID first arc truncation in asn1.oidToDer
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: TLS client crash when the server sends no certificate
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Regular expression denial of service in PEM decoding (pem.decode)
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: AES-GCM authentication bypass via unvalidated tagLength option
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Denial of service in TLS record processing via call stack exhaustion
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
- Affected
- <1.4.1
- Fixed in
- 1.4.1
node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements
- Affected
- <=1.4.0
- Fixed in
- No fix released
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
- Affected
- <1.4.0
- Fixed in
- 1.4.0
Forge has signature forgery in Ed25519 due to missing S > L check
- Affected
- <1.4.0
- Fixed in
- 1.4.0
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
- Affected
- <1.4.0
- Fixed in
- 1.4.0
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
- Affected
- <1.4.0
- Fixed in
- 1.4.0
node-forge has ASN.1 Unbounded Recursion
- Affected
- <1.3.2
- Fixed in
- 1.3.2
node-forge is vulnerable to ASN.1 OID Integer Truncation
- Affected
- <1.3.2
- Fixed in
- 1.3.2
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
- Affected
- <1.3.2
- Fixed in
- 1.3.2
Improper Verification of Cryptographic Signature in `node-forge`
- Affected
- <1.3.0
- Fixed in
- 1.3.0
Improper Verification of Cryptographic Signature in node-forge
- Affected
- <1.3.0
- Fixed in
- 1.3.0
Improper Verification of Cryptographic Signature in node-forge
- Affected
- <1.3.0
- Fixed in
- 1.3.0
Open Redirect in node-forge
- Affected
- <1.0.0
- Fixed in
- 1.0.0
Prototype Pollution in node-forge debug API.
- Affected
- <1.0.0
- Fixed in
- 1.0.0
Prototype Pollution in node-forge util.setPath API
- Affected
- <0.10.0
- Fixed in
- 0.10.0
URL parsing in node-forge could lead to undesired behavior.
- Affected
- <1.0.0
- Fixed in
- 1.0.0
Prototype Pollution in node-forge
- Affected
- <0.10.0
- Fixed in
- 0.10.0
Which of your client projects are still on node-forge 0.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact node-forge version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other node-forge versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.