Login Request a demo
FO
Product
forge
by digitalbazaar · last CVE Sep 3, 2026
13
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities13In the news1Timeline
Severity mix
Critical 1High 9Medium 3Low 0
Severity
All severities13Critical1High9Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add forge to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-33896
9.1
0%
Mar 27
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Affected: < 1.4.0
CVE-2025-12816
8.6
1%
Nov 25
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema…
Affected: through 1.3.1
CVE-2026-85393
7.5
0%
Sep 3
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
Affected: through 1.4.0
CVE-2026-33895
7.5
1%
Mar 27
Forge has signature forgery in Ed25519 due to missing S > L check
Affected: < 1.4.0
CVE-2026-33894
7.5
0%
Mar 27
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Affected: < 1.4.0
CVE-2026-33891
7.5
1%
Mar 27
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Affected: < 1.4.0
CVE-2025-66031
7.5
0%
Nov 26
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Affected: before 1.3.2
CVE-2022-24772
7.5
1%
Mar 18
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Affected: before 1.3.0
CVE-2022-24771
7.5
1%
Mar 18
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Affected: before 1.3.0
CVE-2020-7720
7.3
3%
Sep 1
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function
Affected: before 0.10.0
CVE-2022-0122
6.1
1%
Jan 6
forge is vulnerable to URL Redirection to Untrusted Site
Affected: before 1.0.0
CVE-2025-66030
5.3
0%
Nov 26
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Affected: before 1.3.2
CVE-2022-24773
5.3
1%
Mar 18
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Affected: before 1.3.0
Showing 13