# node-forge (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/node-forge Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/node-forge.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 36 vulnerabilities in node-forge (npm): 5 in the last 7 days and 21 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125335, was published on 10 November 2026. 15 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 5 - Last 30 days: 20 - Last 90 days: 21 - All time: 36 (0 critical, 0 exploited in the wild) ## About node-forge (npm) JavaScript library providing cryptographic functions including RSA, AES, TLS, and other encryption algorithms. ## Latest node-forge (npm) vulnerabilities - [CVE-2026-125335: Forge: Ed25519 signature verification accepts small-order public keys](https://junglewise.ai/threats/cve-2026-125335-forge-also-called-node-forge-is-a-native-implementation-of) (low, CVSS 3.7, published 10 Nov 2026) - [CVE-2026-125334: Forge TLS client crash on handshake record without session](https://junglewise.ai/threats/cve-2026-125334-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-125333: Forge HTTP ReDoS in response header parsing](https://junglewise.ai/threats/cve-2026-125333-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-125332: Forge TLS client crash on unsupported ServerHello compression](https://junglewise.ai/threats/cve-2026-125332-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-119192: Forge RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding](https://junglewise.ai/threats/cve-2026-119192-forge-rsa-pkcs-1-v1-5-signature-forgery-via-non-canonical) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-119191: Forge ASN.1 BIT STRING decoding recursion exhaustion](https://junglewise.ai/threats/cve-2026-119191-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119190: node-forge X.509 basicConstraints bypass via deprecated OIDs](https://junglewise.ai/threats/cve-2026-119190-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.4, published 29 Oct 2026) - [CVE-2026-119189: Forge X.509 pathLenConstraint bypass in certificate verification](https://junglewise.ai/threats/cve-2026-119189-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 29 Oct 2026) - [CVE-2026-119188: Forge TLS handshake denial of service](https://junglewise.ai/threats/cve-2026-119188-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119187: node-forge TLS stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-119187-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119186: Forge AES-GCM authentication bypass with invalid tag length](https://junglewise.ai/threats/cve-2026-119186-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 29 Oct 2026) - [CVE-2026-118782: Forge PKCS#12 MAC validation bypass](https://junglewise.ai/threats/cve-2026-118782-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-118781: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of )](https://junglewise.ai/threats/cve-2026-118781-forge-also-called-node-forge-is-a-native-implementation-of) (low, CVSS 3.1, published 29 Oct 2026) - [CVE-2026-118780: Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store](https://junglewise.ai/threats/cve-2026-118780-forge-also-called-node-forge-is-a-native-implementation-of) (low, CVSS 3.7, published 29 Oct 2026) - [CVE-2026-118779: Forge regular expression denial of service in PEM decoding](https://junglewise.ai/threats/cve-2026-118779-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-118778: Forge TLS client null pointer dereference in certificate validation](https://junglewise.ai/threats/cve-2026-118778-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 29 Oct 2026) - [CVE-2026-118777: Forge prototype pollution in HTTP cookie handling](https://junglewise.ai/threats/cve-2026-118777-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-118776: Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption](https://junglewise.ai/threats/cve-2026-118776-forge-also-called-node-forge-is-a-native-implementation-of) (low, CVSS 3.7, published 29 Oct 2026) - [CVE-2026-118775: Forge: ASN.1 OID first arc truncation in asn1.oidToDer](https://junglewise.ai/threats/cve-2026-118775-forge-also-called-node-forge-is-a-native-implementation-of) (low, CVSS 3.7, published 29 Oct 2026) - [CVE-2026-118774: Forge: Certificate signature verified with the issuer's RSA signature scheme](https://junglewise.ai/threats/cve-2026-118774-forge-also-called-node-forge-is-a-native-implementation-of) (low, CVSS 3.7, published 29 Oct 2026) - [CVE-2026-85393: node-forge RSA signature forgery via ASN.1 parsing bypass](https://junglewise.ai/threats/cve-2026-85393-node-forge-rsa-signature-forgery-via-asn-1-parsing-bypass) (high, CVSS 7.5, published 3 Sep 2026) - [CVE-2026-33896: Digital Bazaar node-forge certificate validation bypass in verifyCertificateChain](https://junglewise.ai/threats/cve-2026-33896-digital-bazaar-node-forge-certificate-validation-bypass-in) (high, CVSS 7.4, published 27 Mar 2026) - [CVE-2026-33895: Digital Bazaar Forge signature malleability in Ed25519](https://junglewise.ai/threats/cve-2026-33895-digital-bazaar-forge-signature-malleability-in-ed25519) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33894: Digital Bazaar node-forge signature forgery in RSASSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2026-33894-digital-bazaar-node-forge-signature-forgery-in-rsassa-pkcs-1-v1-5) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33891: Digital Bazaar node-forge infinite loop in BigInteger.modInverse](https://junglewise.ai/threats/cve-2026-33891-digital-bazaar-node-forge-infinite-loop-in-biginteger-modinverse) (high, CVSS 7.5, published 27 Mar 2026) ## Most severe node-forge (npm) vulnerabilities - [CVE-2025-12816: node-forge ASN.1 validator desynchronization](https://junglewise.ai/threats/cve-2025-12816-node-forge-asn-1-validator-desynchronization) (high, CVSS 8.6, published 25 Nov 2025) - [CVE-2026-33891: Digital Bazaar node-forge infinite loop in BigInteger.modInverse](https://junglewise.ai/threats/cve-2026-33891-digital-bazaar-node-forge-infinite-loop-in-biginteger-modinverse) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-118779: Forge regular expression denial of service in PEM decoding](https://junglewise.ai/threats/cve-2026-118779-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-33895: Digital Bazaar Forge signature malleability in Ed25519](https://junglewise.ai/threats/cve-2026-33895-digital-bazaar-forge-signature-malleability-in-ed25519) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33894: Digital Bazaar node-forge signature forgery in RSASSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2026-33894-digital-bazaar-node-forge-signature-forgery-in-rsassa-pkcs-1-v1-5) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-119191: Forge ASN.1 BIT STRING decoding recursion exhaustion](https://junglewise.ai/threats/cve-2026-119191-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2025-66031: node-forge ASN.1 unbounded recursion denial of service](https://junglewise.ai/threats/cve-2025-66031-node-forge-asn-1-unbounded-recursion-denial-of-service) (high, CVSS 7.5, published 26 Nov 2025) - [CVE-2026-119188: Forge TLS handshake denial of service](https://junglewise.ai/threats/cve-2026-119188-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119187: node-forge TLS stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-119187-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-85393: node-forge RSA signature forgery via ASN.1 parsing bypass](https://junglewise.ai/threats/cve-2026-85393-node-forge-rsa-signature-forgery-via-asn-1-parsing-bypass) (high, CVSS 7.5, published 3 Sep 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 15 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "node-forge (npm) vulnerabilities", https://junglewise.ai/threats/technologies/node-forge, 13 November 2026.