CVE-2026-125333

The Forge (node-forge) JavaScript TLS implementation is vulnerable to a Regular Expression Denial of Service (ReDoS) in versions 0.1.2 through 1.4.3 . The _trimString() function in lib/http.js uses a regular expression to remove trailing whitespace from response header values and cookie names/val...

CVE-2026-125333 Forge: ReDoS in forge.http response header and cookie trimming

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take...