npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer

npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encod...