CVE-2026-118782

The Forge (node-forge) JavaScript library, prior to version 1.4.1 , is vulnerable to a flaw where it accepts a PKCS#12 MAC or password-based encryption iteration count of zero or less. This causes pki.pbe.generatePkcs12Key() to return a constant key regardless of the provided password and salt. C...