Ddigitalbazaar

Products

Exploited and recent CVEs

• CVE-2026-119191 High 7.5 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer 0.4%
• CVE-2026-119190 High 7.4 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 0.2%
• CVE-2026-119189 Medium 5.9 Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage 0.2%
• CVE-2026-119188 High 7.5 Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message 0.4%
• CVE-2026-119187 High 7.5 Forge: Denial of service in TLS record processing via call stack exhaustion 0.4%
• CVE-2026-119186 Medium 5.9 Forge: AES-GCM authentication bypass via unvalidated tagLength option 0.2%
• CVE-2026-118782 High 7.5 Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count 0.1%
• CVE-2026-118781 Low 2.9 Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) 0.1%
• CVE-2026-118780 Low 3.7 Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store 0.2%
• CVE-2026-118779 High 7.5 Forge: Regular expression denial of service in PEM decoding (pem.decode) 0.6%
• CVE-2026-118778 Medium 5.9 Forge: TLS client crash when the server sends no certificate 0.2%
• CVE-2026-118777 Medium 4.8 Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie 0.3%
• CVE-2026-118776 Low 3.7 Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption 0.1%
• CVE-2026-118775 Low 3.7 Forge: ASN.1 OID first arc truncation in asn1.oidToDer 0.3%
• CVE-2026-118774 Low 3.7 Forge: Certificate signature verified with the issuer's RSA signature scheme 0.1%
• CVE-2026-85393 High 7.5 node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding 0.2%
• CVE-2026-33896 High 7.4 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) 0.4%
• CVE-2026-33895 High 7.5 Forge has signature forgery in Ed25519 due to missing S > L check 0.5%
• CVE-2026-33894 High 7.5 Forge has signature forgery in RSA-PKCS due to ASN.1 extra field 0.5%
• CVE-2026-33891 High 7.5 Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input 0.6%
• CVE-2025-66030 Medium 6.3 node-forge ASN.1 OID Integer Truncation 0.3%
• CVE-2025-66031 High 8.7 node-forge ASN.1 Unbounded Recursion 0.4%
• CVE-2024-31995 Medium 4.3 zcap has incomplete expiration checks in capability chains. 0.4%
• CVE-2022-24772 High 7.5 Improper Verification of Cryptographic Signature in `node-forge` 1.1%
• CVE-2022-24773 Medium 5.3 Improper Verification of Cryptographic Signature in `node-forge` 1.0%
• CVE-2022-24771 High 7.5 Improper Verification of Cryptographic Signature in node-forge 0.8%
• CVE-2022-0122 Medium 5.3 Open Redirect in digitalbazaar/forge 0.9%