Is node-forge 1.4 vulnerable?

npm · 3 releases from 1.4.0 to 1.4.2 · latest node-forge is 1.4.2 · checked 2 Nov 2026

No known advisories in the last release

node-forge 1.4.2, the last 1.4 release, has no known advisories. 12 advisories affect earlier 1.4.x releases, so update to 1.4.2.

Update within 1.4:npm install node-forge@1.4.2

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 1.4.x, affecting earlier releases

  • LowCVE-2026-118775GHSA-4642-5mcj-2rqw30 Oct 2026

    Forge: ASN.1 OID first arc truncation in asn1.oidToDer

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • MediumCVE-2026-118777GHSA-6wvx-3r32-xmcg30 Oct 2026

    Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • MediumCVE-2026-118778GHSA-525v-9gp9-w22h30 Oct 2026

    Forge: TLS client crash when the server sends no certificate

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-118779GHSA-7wch-p9px-956x30 Oct 2026

    Forge: Regular expression denial of service in PEM decoding (pem.decode)

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • LowCVE-2026-118781GHSA-h6cr-wjv9-3cpp30 Oct 2026

    Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • LowCVE-2026-118780GHSA-4487-j8r4-4g2f30 Oct 2026

    Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • MediumCVE-2026-119186GHSA-5cwg-6vw7-rj6p30 Oct 2026

    Forge: AES-GCM authentication bypass via unvalidated tagLength option

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-118782GHSA-jc66-7q78-782g30 Oct 2026

    Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-119188GHSA-8hrf-8g6f-7xwp30 Oct 2026

    Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-119187GHSA-hqq3-7jhf-c5jx30 Oct 2026

    Forge: Denial of service in TLS record processing via call stack exhaustion

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-119190GHSA-5x38-2vff-x55p30 Oct 2026

    Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

    Affected
    <1.4.1
    Fixed in
    1.4.1
  • HighCVE-2026-33894GHSA-86w9-cpqp-85rv3 Sept 2026

    node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

    Affected
    <=1.4.0
    Fixed in
    No fix released

Which of your client projects are still on node-forge 1.4?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact node-forge version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other node-forge versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.