CVE-2026-118775: Forge: ASN.1 OID first arc truncation in asn1.oidToDer

October 30, 2026

asn1.oidToDer() did not range-check the first two arcs of an OID string, so an OID such as 0.42.840.113549.1.1.1 or 4294977127.18.840.113549.1.1.1 was encoded as the DER of a different OID (here rsaEncryption, 1.2.840.113549.1.1.1). This is an incomplete fix of CVE-2025-66030. Fixed in node-forge 1.4.1.

References

github.com/advisories/GHSA-4642-5mcj-2rqw
github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e
github.com/digitalbazaar/forge/releases/tag/v1.4.1
github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw
nvd.nist.gov/vuln/detail/CVE-2026-118775

Code Behaviors & Features

Detect and mitigate CVE-2026-118775 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →