Is CVE-2026-119186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119186 being exploited in the wild.

How severe is CVE-2026-119186?

Medium severity, with a CVSS score of 5.9, published 29 October 2026.

Which products and versions are affected?

Digital Bazaar Forge (node-forge) prior to 1.4.1; node-forge (npm) <= 1.4.0, SEMVER:introduced=0,fixed=1.4.1.

Is there a fix for CVE-2026-119186?

Yes. node-forge (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119186 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119186?

Check whether you run Digital Bazaar Forge (node-forge) or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119186: Forge AES-GCM authentication bypass with invalid tag length

Q: Is there a fix for CVE-2026-119186?

Yes. node-forge (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-119186 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-119186?

Check whether you run Digital Bazaar Forge (node-forge) or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119186 · Severity: medium · CVSS 5.9 · Published 2026-10-29

Forge (node-forge) is a JavaScript cryptography library used to implement secure TLS communications in web applications. A flaw in AES-GCM decryption validation allows attackers to bypass authentication checks if an application improperly configures the tag length, potentially accepting forged or tampered encrypted data as legitimate.

Technologies: node-forge (npm). Vendors: Digital Bazaar, npm.

Quick answers

Is CVE-2026-119186 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119186 being exploited in the wild.
How severe is CVE-2026-119186?: Medium severity, with a CVSS score of 5.9, published 29 October 2026.
Which products and versions are affected?: Digital Bazaar Forge (node-forge) prior to 1.4.1; node-forge (npm) <= 1.4.0, SEMVER:introduced=0,fixed=1.4.1.
Is there a fix for CVE-2026-119186?: Yes. node-forge (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119186 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119186?: Check whether you run Digital Bazaar Forge (node-forge) or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-forge (npm): upgrade to 1.4.1 or later
```
npm install node-forge@1.4.1
```

Technical details

The vulnerability stems from missing validation of the AES-GCM tagLength option in the decipher.start() method. When tagLength is set to zero or a falsy value (null, false, empty string, or '0'), the authentication tag calculation becomes 0 bits, causing both computed and supplied tags to compare as empty and pass validation. Attack requires an application to derive tagLength from untrusted input or use a misconfigured value; default tagLength of 128 bits and fixed valid lengths are unaffected.

Affected products

Digital Bazaar Forge (node-forge) prior to 1.4.1

Identifiers

CVE-2026-119186
GHSA-5cwg-6vw7-rj6p

Timeline

2026-10-29: disclosed
2026-10-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.