Vulnerability · Published Oct 29, 2026 · Assigned by GitHub_M

CVE-2026-119191Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

High 7.5

In plain English

A high-severity uncontrolled resource consumption in forge from digitalbazaar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 62.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	node-node-forge	no fix listed	UBUNTU-CVE-2026-119191

Affected products (as reported)

Vendor	Product	Versions
digitalbazaar	forge	< 1.4.1

Weakness: CWE-400, CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29 x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4b x_refsource_MISC
https://github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7 x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1 x_refsource_MISC