EUVD-2026-113363

Forge: AES-GCM authentication bypass via unvalidated tagLength option...

CVE-2026-119186

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

CVE-2026-119186

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

CVE-2026-119186

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

PT-2026-132806

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1 Description Forge also known as node-forge fails to validate the tagLength option passed to the start function during decryption via forge.cipher.createDecipher. If an application uses a tagLength derived from...

CVE-2026-119186: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start during decryption through forge.cipher.createDecipher. When an application derived tagLength from received da...

PT-2026-82765

Name of the Vulnerable Software and Affected Versions Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6 Description The RADOS Gateway RGW uses an AES-128-CBC handler to protect STS session tokens that lacks message authentication. This allows an attacker with a valid STS token to perfor...

Insufficient Verification of Data Authenticity

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...