CVEvulnerability

CVE-2026-118780

3.7 LOW EPSS 0.17% Published 2026-10-29 Modified 2026-10-30 Official page ↗

Exploitation and prioritisation

EPSS
0.17% chance of exploitation in the next 30 days · in the top 93.4% of all CVEs (2026-11-03)
EU Vulnerability Database
EUVD-2026-113338

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
npmnode-forge< 1.4.11.4.1GHSA-4487-j8r4-4g2f
Status
Undergoing Analysis
Published
2026-10-29
Last modified
2026-10-30
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-295, CWE-471

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.

Related

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-4487-j8r4-4g2f Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store advisory · npm

References