CVE-2026-125333

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take...

CVE-2026-125333

The Forge (node-forge) JavaScript TLS implementation is vulnerable to a Regular Expression Denial of Service (ReDoS) in versions 0.1.2 through 1.4.3 . The _trimString() function in lib/http.js uses a regular expression to remove trailing whitespace from response header values and cookie names/val...

CVE-2026-125333 Forge: ReDoS in forge.http response header and cookie trimming

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take...

EUVD-2026-122793

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take...

CVE-2026-125333: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take...

Prototype Pollution

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Prototype Pollution in the client.setCookie function in lib/http.js. A malicious server can add or...

Prototype Pollution

Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Prototype Pollution in the client.setCookie function in lib/http.js. A malicious server can add or delete Object.prototype and Object properties across the entire JavaScript realm b...