CVE-2026-118779

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode, lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in...

EUVD-2026-113337

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode, lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in...

CVE-2026-118779 Forge: Regular expression denial of service in PEM decoding (pem.decode)

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode, lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in...

CVE-2026-118779

The Forge (also known as node-forge ) JavaScript library, a native implementation of Transport Layer Security, is vulnerable to a Regular Expression Denial of Service (ReDoS) in versions prior to 1.4.1 . The root cause is the use of polynomial-time regular expressions within the pem.decode() func...