Is CVE-2026-118777 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118777 being exploited in the wild.

How severe is CVE-2026-118777?

Medium severity, with a CVSS score of 4.8, published 29 October 2026.

Which products and versions are affected?

Digital Bazaar Forge prior to 1.4.1; node-forge (npm) <= 1.4.0, SEMVER:introduced=0,fixed=1.4.1.

Is there a fix for CVE-2026-118777?

Yes. node-forge (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118777 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118777?

Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118777: Forge prototype pollution in HTTP cookie handling

Q: Is there a fix for CVE-2026-118777?

Yes. node-forge (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118777 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118777?

Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118777 · Severity: medium · CVSS 4.8 · Published 2026-10-29

Forge is a JavaScript library that implements Transport Layer Security and HTTP functionality. A malicious server can exploit how Forge handles HTTP cookies to inject properties into JavaScript objects, potentially modifying application behavior or gaining unauthorized access to sensitive data. This affects applications using Forge's HTTP or XHR features.

Technologies: Digital Bazaar Forge, node-forge (npm). Vendors: Digital Bazaar, npm.

Quick answers

Is CVE-2026-118777 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118777 being exploited in the wild.
How severe is CVE-2026-118777?: Medium severity, with a CVSS score of 4.8, published 29 October 2026.
Which products and versions are affected?: Digital Bazaar Forge prior to 1.4.1; node-forge (npm) <= 1.4.0, SEMVER:introduced=0,fixed=1.4.1.
Is there a fix for CVE-2026-118777?: Yes. node-forge (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118777 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118777?: Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-forge (npm): upgrade to 1.4.1 or later
```
npm install node-forge@1.4.1
```

Technical details

The forge.http client stores Set-Cookie header data in plain JavaScript objects without filtering reserved property names. An attacker can use cookie names like __proto__ or constructor to trigger prototype pollution, allowing modification of Object.prototype and Object constructor properties. The vulnerability requires a malicious HTTP server and affects only applications that directly use forge.http or forge.xhr.

Affected products

Digital Bazaar Forge prior to 1.4.1

Identifiers

CVE-2026-118777
GHSA-6wvx-3r32-xmcg

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.