CVE-2026-118779
Received
Received - Intake
Denial of Service in node-forge PEM Parsing
Vulnerability report for CVE-2026-118779, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-29
Last updated on: 2026-10-29
Assigner: GitHub, Inc.
Description
Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| digitalbazaar | forge | < 1.4.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1333 | The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential. |
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
