46 matches found
SUSE CVE-2026-118780
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain, pki.createCaStore, duplicate subject names to process the relevant input or security decision. node-forge modified the CA...
Linux Distros Unpatched Vulnerability : CVE-2026-118780
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used...
Linux Distros Unpatched Vulnerability : CVE-2026-119190
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs...
Modification of Assumed-Immutable Data (MAID)
Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID in the pki.verifyCertificateChain function in lib/x509.js...
Modification of Assumed-Immutable Data (MAID)
Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID in the pki.verifyCertificateChain function in lib/x509.js. An attacker can permanently disable verification against an affected trusted C...
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
Summary When a CA store created by pki.createCaStore holds two or more certificates with the same subject name, pki.verifyCertificateChain permanently removes those certificates from the store while trying each one as the issuer. A peer can send any certificate that names that subject as its issu...
EUVD-2026-113338
Forge: verifyCertificateChain removes trusted CA certificates with the same subject from the CA store...
GHSA-4487-J8R4-4G2F Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
Summary When a CA store created by pki.createCaStore holds two or more certificates with the same subject name, pki.verifyCertificateChain permanently removes those certificates from the store while trying each one as the issuer. A peer can send any certificate that names that subject as its issu...
EUVD-2026-113347
Forge: X.509 basicConstraints bypass in verifyCertificateChain via deprecated extension OIDs 2.5.29.10 and 2.5.29.13...
Linux Distros Unpatched Vulnerability : CVE-2026-119189
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's...
UBUNTU-CVE-2026-118780
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain, pki.createCaStore, duplicate subject names to process the relevant input or security decision. node-forge modified the CA...
UBUNTU-CVE-2026-119189
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...
UBUNTU-CVE-2026-119190
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...
CVE-2026-119190
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...
AZL-112499 CVE-2026-119190 affecting package python-tensorboard 2.16.2-6
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...
CVE-2026-119189
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...
AZL-112463 CVE-2026-119189 affecting package python-tensorboard 2.16.2-6
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...
CVE-2026-119189
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...
CVE-2026-119190
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...
CVE-2026-119190
Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...