CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...

CVE-2026-118775

The Forge (node-forge) JavaScript TLS implementation is vulnerable in versions prior to 1.4.1 due to a missing range-check in the asn1.oidToDer() function within lib/asn1.js . An attacker providing an untrusted OID string that the application authorizes could cause the software to emit a DER repr...