Low severity · published Oct 29, 2026
CVE-2026-118775
Forge: ASN.1 OID first arc truncation in asn1.oidToDer
New
3.7
CVSS
–
EPSS
No
On KEV
Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
forge · digitalbazaar
< 1.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118775
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118775
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw
x_refsource_MISC
https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e
x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
More from forge
9.1
CVE-2026-33896
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
8.6
CVE-2025-12816
No description published yet
7.5
CVE-2026-119191
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
CVE-2026-119188
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
7.5
CVE-2026-119187
Forge: Denial of service in TLS record processing via call stack exhaustion