7 matches found
CVE-2026-118779
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode, lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in...
EUVD-2026-113337
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode, lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in...
CVE-2026-118779
The Forge (also known as node-forge ) JavaScript library, a native implementation of Transport Layer Security, is vulnerable to a Regular Expression Denial of Service (ReDoS) in versions prior to 1.4.1 . The root cause is the use of polynomial-time regular expressions within the pem.decode() func...
CVE-2026-118779 Forge: Regular expression denial of service in PEM decoding (pem.decode)
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode, lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in...
jfrog-CVE-2022-24675
CVE-2022-24675 tools Usage instructions cve202224675.sh rootfolder Will recursively walk the specified folder and report Golang binaries which use pem.Decode function, or are stripped in which case function name will be missed and the check will not be effective...
PT-2026-35101
Summary The trustedCertPool function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates e.g., intermediate + root CA, only the first certificate is loaded. This silently breaks certificate chain validation for mTLS...
