Is node-forge 1.3 vulnerable?
npm · 4 releases from 1.3.0 to 1.3.3 · latest node-forge is 1.4.2 · checked 1 Nov 2026
Yes: 16 known advisories
Yes. node-forge 1.3.3, the last 1.3 release, is affected by 16 known security advisories (10 high, 3 medium, 3 low), including CVE-2026-118779, CVE-2026-118782, CVE-2026-119188. 3 more affect earlier 1.3.x releases. At least one has no fixed release yet.
Advisories affecting node-forge 1.3.3
Forge: ASN.1 OID first arc truncation in asn1.oidToDer
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: TLS client crash when the server sends no certificate
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Regular expression denial of service in PEM decoding (pem.decode)
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: AES-GCM authentication bypass via unvalidated tagLength option
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: Denial of service in TLS record processing via call stack exhaustion
- Affected
- <1.4.1
- Fixed in
- 1.4.1
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
- Affected
- <1.4.1
- Fixed in
- 1.4.1
node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements
- Affected
- <=1.4.0
- Fixed in
- No fix released
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
- Affected
- <1.4.0
- Fixed in
- 1.4.0
Forge has signature forgery in Ed25519 due to missing S > L check
- Affected
- <1.4.0
- Fixed in
- 1.4.0
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
- Affected
- <1.4.0
- Fixed in
- 1.4.0
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
- Affected
- <1.4.0
- Fixed in
- 1.4.0
Fixed within 1.3.x, affecting earlier releases
node-forge has ASN.1 Unbounded Recursion
- Affected
- <1.3.2
- Fixed in
- 1.3.2
node-forge is vulnerable to ASN.1 OID Integer Truncation
- Affected
- <1.3.2
- Fixed in
- 1.3.2
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
- Affected
- <1.3.2
- Fixed in
- 1.3.2
Which of your client projects are still on node-forge 1.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact node-forge version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other node-forge versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.