CVE-2026-119191: Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
asn1.fromDer() decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the maxDepth recursion limit (an incomplete fix of CVE-2025-66031) and also decoded nested BIT STRINGs, keeping a full copy of the decoded contents at each level, so small crafted DER or PEM inputs (certificates, keys, PKCS structures) use excessive CPU time and memory and can abort the Node.js process. Fixed in node-forge 1.4.1.
References
- github.com/advisories/GHSA-rhr8-3pm8-cq29
- github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4b
- github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7
- github.com/digitalbazaar/forge/releases/tag/v1.4.1
- github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29
- nvd.nist.gov/vuln/detail/CVE-2026-119191
Code Behaviors & Features
Detect and mitigate CVE-2026-119191 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →