# Digital Bazaar Forge vulnerabilities Source: https://junglewise.ai/threats/technologies/forge Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/forge.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 29 vulnerabilities in Digital Bazaar Forge: 5 in the last 7 days and 15 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125336, was published on 10 November 2026. 9 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 5 - Last 30 days: 14 - Last 90 days: 15 - All time: 29 (0 critical, 0 exploited in the wild) ## About Digital Bazaar Forge JavaScript library for cryptographic operations and secure credential handling in web applications. ## Latest Digital Bazaar Forge vulnerabilities - [CVE-2026-125336: Forge X.509 certificate chain verification ignores nameConstraints](https://junglewise.ai/threats/cve-2026-125336-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.4, published 10 Nov 2026) - [CVE-2026-125334: Forge TLS client crash on handshake record without session](https://junglewise.ai/threats/cve-2026-125334-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-125333: Forge HTTP ReDoS in response header parsing](https://junglewise.ai/threats/cve-2026-125333-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-125332: Forge TLS client crash on unsupported ServerHello compression](https://junglewise.ai/threats/cve-2026-125332-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-119192: Forge RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding](https://junglewise.ai/threats/cve-2026-119192-forge-rsa-pkcs-1-v1-5-signature-forgery-via-non-canonical) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-119191: Forge ASN.1 BIT STRING decoding recursion exhaustion](https://junglewise.ai/threats/cve-2026-119191-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119190: node-forge X.509 basicConstraints bypass via deprecated OIDs](https://junglewise.ai/threats/cve-2026-119190-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.4, published 29 Oct 2026) - [CVE-2026-119189: Forge X.509 pathLenConstraint bypass in certificate verification](https://junglewise.ai/threats/cve-2026-119189-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 29 Oct 2026) - [CVE-2026-119188: Forge TLS handshake denial of service](https://junglewise.ai/threats/cve-2026-119188-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119187: node-forge TLS stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-119187-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-118782: Forge PKCS#12 MAC validation bypass](https://junglewise.ai/threats/cve-2026-118782-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-118779: Forge regular expression denial of service in PEM decoding](https://junglewise.ai/threats/cve-2026-118779-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-118778: Forge TLS client null pointer dereference in certificate validation](https://junglewise.ai/threats/cve-2026-118778-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 29 Oct 2026) - [CVE-2026-118777: Forge prototype pollution in HTTP cookie handling](https://junglewise.ai/threats/cve-2026-118777-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-85393: node-forge RSA signature forgery via ASN.1 parsing bypass](https://junglewise.ai/threats/cve-2026-85393-node-forge-rsa-signature-forgery-via-asn-1-parsing-bypass) (high, CVSS 7.5, published 3 Sep 2026) - [CVE-2026-33896: Digital Bazaar node-forge certificate validation bypass in verifyCertificateChain](https://junglewise.ai/threats/cve-2026-33896-digital-bazaar-node-forge-certificate-validation-bypass-in) (high, CVSS 7.4, published 27 Mar 2026) - [CVE-2026-33895: Digital Bazaar Forge signature malleability in Ed25519](https://junglewise.ai/threats/cve-2026-33895-digital-bazaar-forge-signature-malleability-in-ed25519) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33894: Digital Bazaar node-forge signature forgery in RSASSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2026-33894-digital-bazaar-node-forge-signature-forgery-in-rsassa-pkcs-1-v1-5) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33891: Digital Bazaar node-forge infinite loop in BigInteger.modInverse](https://junglewise.ai/threats/cve-2026-33891-digital-bazaar-node-forge-infinite-loop-in-biginteger-modinverse) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2025-66031: node-forge ASN.1 unbounded recursion denial of service](https://junglewise.ai/threats/cve-2025-66031-node-forge-asn-1-unbounded-recursion-denial-of-service) (high, CVSS 7.5, published 26 Nov 2025) - [CVE-2025-66030: node-forge ASN.1 OID integer overflow](https://junglewise.ai/threats/cve-2025-66030-node-forge-asn-1-oid-integer-overflow) (medium, CVSS 5.3, published 26 Nov 2025) - [CVE-2025-12816: node-forge ASN.1 validator desynchronization](https://junglewise.ai/threats/cve-2025-12816-node-forge-asn-1-validator-desynchronization) (high, CVSS 8.6, published 25 Nov 2025) - [CVE-2022-24773: Digital Bazaar node-forge signature forgery in RSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2022-24773-digital-bazaar-node-forge-signature-forgery-in-rsa-pkcs-1-v1-5) (low, CVSS 3.1, published 18 Mar 2022) - [CVE-2022-24772: node-forge RSA PKCS#1 v1.5 signature forgery](https://junglewise.ai/threats/cve-2022-24772-node-forge-rsa-pkcs-1-v1-5-signature-forgery) (low, CVSS 3.1, published 18 Mar 2022) - [CVE-2022-24771: node-forge RSA signature forgery in PKCS#1 v1.5 verification](https://junglewise.ai/threats/cve-2022-24771-node-forge-rsa-signature-forgery-in-pkcs-1-v1-5-verification) (low, CVSS 3.1, published 18 Mar 2022) ## Most severe Digital Bazaar Forge vulnerabilities - [CVE-2025-12816: node-forge ASN.1 validator desynchronization](https://junglewise.ai/threats/cve-2025-12816-node-forge-asn-1-validator-desynchronization) (high, CVSS 8.6, published 25 Nov 2025) - [CVE-2026-33891: Digital Bazaar node-forge infinite loop in BigInteger.modInverse](https://junglewise.ai/threats/cve-2026-33891-digital-bazaar-node-forge-infinite-loop-in-biginteger-modinverse) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-118779: Forge regular expression denial of service in PEM decoding](https://junglewise.ai/threats/cve-2026-118779-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-33895: Digital Bazaar Forge signature malleability in Ed25519](https://junglewise.ai/threats/cve-2026-33895-digital-bazaar-forge-signature-malleability-in-ed25519) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33894: Digital Bazaar node-forge signature forgery in RSASSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2026-33894-digital-bazaar-node-forge-signature-forgery-in-rsassa-pkcs-1-v1-5) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-119191: Forge ASN.1 BIT STRING decoding recursion exhaustion](https://junglewise.ai/threats/cve-2026-119191-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2025-66031: node-forge ASN.1 unbounded recursion denial of service](https://junglewise.ai/threats/cve-2025-66031-node-forge-asn-1-unbounded-recursion-denial-of-service) (high, CVSS 7.5, published 26 Nov 2025) - [CVE-2026-119188: Forge TLS handshake denial of service](https://junglewise.ai/threats/cve-2026-119188-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119187: node-forge TLS stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-119187-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-85393: node-forge RSA signature forgery via ASN.1 parsing bypass](https://junglewise.ai/threats/cve-2026-85393-node-forge-rsa-signature-forgery-via-asn-1-parsing-bypass) (high, CVSS 7.5, published 3 Sep 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 9 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## Other Digital Bazaar technologies - [Digital Bazaar Node-Forge](https://junglewise.ai/threats/technologies/digital-bazaar-node-forge): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Digital Bazaar Forge vulnerabilities", https://junglewise.ai/threats/technologies/forge, 11 November 2026.