CVEvulnerability

CVE-2026-118779

7.5 HIGH EPSS 0.56% Published 2026-10-29 Modified 2026-10-30 Official page ↗

Exploitation and prioritisation

EPSS: 0.56% chance of exploitation in the next 30 days · in the top 53.6% of all CVEs (2026-11-03)
CISA SSVC: exploitation: poc
CISA SSVC: automatable: yes
CISA SSVC: technical impact: partial
EU Vulnerability Database: EUVD-2026-113337

Affected packages

Ecosystem	Package	Vulnerable	Fixed in	Advisory
npm	`node-forge`	< 1.4.1	1.4.1	GHSA-7wch-p9px-956x

Status: Undergoing Analysis
Published: 2026-10-29
Last modified: 2026-10-30
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-1333, CWE-400

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.

Weakness · CWE (2)

CWE-1333 Inefficient Regular Expression Complexity weakness
CWE-400 Uncontrolled Resource Consumption weakness

Referenced by GitHub Advisory · alias (1)

GHSA-7wch-p9px-956x Forge: Regular expression denial of service in PEM decoding (pem.decode) advisory · npm