# Digital Bazaar vulnerabilities Source: https://junglewise.ai/threats/vendors/digital-bazaar Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/digital-bazaar.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in Digital Bazaar: 5 in the last 7 days and 16 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125336, was published on 10 November 2026. 10 vulnerabilities in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 15 - Last 90 days: 16 - All time: 31 (0 critical, 0 exploited in the wild) ## About Digital Bazaar Digital Bazaar is a software development company specializing in decentralized identity and verifiable credential technologies. ## Latest Digital Bazaar vulnerabilities - [CVE-2026-125336: Forge X.509 certificate chain verification ignores nameConstraints](https://junglewise.ai/threats/cve-2026-125336-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.4, published 10 Nov 2026) - [CVE-2026-125334: Forge TLS client crash on handshake record without session](https://junglewise.ai/threats/cve-2026-125334-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-125333: Forge HTTP ReDoS in response header parsing](https://junglewise.ai/threats/cve-2026-125333-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-125332: Forge TLS client crash on unsupported ServerHello compression](https://junglewise.ai/threats/cve-2026-125332-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-119192: Forge RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding](https://junglewise.ai/threats/cve-2026-119192-forge-rsa-pkcs-1-v1-5-signature-forgery-via-non-canonical) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-119191: Forge ASN.1 BIT STRING decoding recursion exhaustion](https://junglewise.ai/threats/cve-2026-119191-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119190: node-forge X.509 basicConstraints bypass via deprecated OIDs](https://junglewise.ai/threats/cve-2026-119190-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.4, published 29 Oct 2026) - [CVE-2026-119189: Forge X.509 pathLenConstraint bypass in certificate verification](https://junglewise.ai/threats/cve-2026-119189-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 29 Oct 2026) - [CVE-2026-119188: Forge TLS handshake denial of service](https://junglewise.ai/threats/cve-2026-119188-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119187: node-forge TLS stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-119187-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119186: Forge AES-GCM authentication bypass with invalid tag length](https://junglewise.ai/threats/cve-2026-119186-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 29 Oct 2026) - [CVE-2026-118782: Forge PKCS#12 MAC validation bypass](https://junglewise.ai/threats/cve-2026-118782-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-118779: Forge regular expression denial of service in PEM decoding](https://junglewise.ai/threats/cve-2026-118779-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-118778: Forge TLS client null pointer dereference in certificate validation](https://junglewise.ai/threats/cve-2026-118778-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 5.9, published 29 Oct 2026) - [CVE-2026-118777: Forge prototype pollution in HTTP cookie handling](https://junglewise.ai/threats/cve-2026-118777-forge-also-called-node-forge-is-a-native-implementation-of) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-85393: node-forge RSA signature forgery via ASN.1 parsing bypass](https://junglewise.ai/threats/cve-2026-85393-node-forge-rsa-signature-forgery-via-asn-1-parsing-bypass) (high, CVSS 7.5, published 3 Sep 2026) - [CVE-2026-33896: Digital Bazaar node-forge certificate validation bypass in verifyCertificateChain](https://junglewise.ai/threats/cve-2026-33896-digital-bazaar-node-forge-certificate-validation-bypass-in) (high, CVSS 7.4, published 27 Mar 2026) - [CVE-2026-33895: Digital Bazaar Forge signature malleability in Ed25519](https://junglewise.ai/threats/cve-2026-33895-digital-bazaar-forge-signature-malleability-in-ed25519) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33894: Digital Bazaar node-forge signature forgery in RSASSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2026-33894-digital-bazaar-node-forge-signature-forgery-in-rsassa-pkcs-1-v1-5) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33891: Digital Bazaar node-forge infinite loop in BigInteger.modInverse](https://junglewise.ai/threats/cve-2026-33891-digital-bazaar-node-forge-infinite-loop-in-biginteger-modinverse) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2025-66031: node-forge ASN.1 unbounded recursion denial of service](https://junglewise.ai/threats/cve-2025-66031-node-forge-asn-1-unbounded-recursion-denial-of-service) (high, CVSS 7.5, published 26 Nov 2025) - [CVE-2025-66030: node-forge ASN.1 OID integer overflow](https://junglewise.ai/threats/cve-2025-66030-node-forge-asn-1-oid-integer-overflow) (medium, CVSS 5.3, published 26 Nov 2025) - [CVE-2025-12816: node-forge ASN.1 validator desynchronization](https://junglewise.ai/threats/cve-2025-12816-node-forge-asn-1-validator-desynchronization) (high, CVSS 8.6, published 25 Nov 2025) - [CVE-2024-31995: Digital Bazaar zcap incomplete expiration checks in capability chains](https://junglewise.ai/threats/cve-2024-31995-digital-bazaar-zcap-incomplete-expiration-checks-in-capability) (low, CVSS 3.1, published 10 Apr 2024) - [CVE-2022-24773: Digital Bazaar node-forge signature forgery in RSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2022-24773-digital-bazaar-node-forge-signature-forgery-in-rsa-pkcs-1-v1-5) (low, CVSS 3.1, published 18 Mar 2022) ## Most severe Digital Bazaar vulnerabilities - [CVE-2025-12816: node-forge ASN.1 validator desynchronization](https://junglewise.ai/threats/cve-2025-12816-node-forge-asn-1-validator-desynchronization) (high, CVSS 8.6, published 25 Nov 2025) - [CVE-2026-33891: Digital Bazaar node-forge infinite loop in BigInteger.modInverse](https://junglewise.ai/threats/cve-2026-33891-digital-bazaar-node-forge-infinite-loop-in-biginteger-modinverse) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-118779: Forge regular expression denial of service in PEM decoding](https://junglewise.ai/threats/cve-2026-118779-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-33895: Digital Bazaar Forge signature malleability in Ed25519](https://junglewise.ai/threats/cve-2026-33895-digital-bazaar-forge-signature-malleability-in-ed25519) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33894: Digital Bazaar node-forge signature forgery in RSASSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2026-33894-digital-bazaar-node-forge-signature-forgery-in-rsassa-pkcs-1-v1-5) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-119191: Forge ASN.1 BIT STRING decoding recursion exhaustion](https://junglewise.ai/threats/cve-2026-119191-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2025-66031: node-forge ASN.1 unbounded recursion denial of service](https://junglewise.ai/threats/cve-2025-66031-node-forge-asn-1-unbounded-recursion-denial-of-service) (high, CVSS 7.5, published 26 Nov 2025) - [CVE-2026-119188: Forge TLS handshake denial of service](https://junglewise.ai/threats/cve-2026-119188-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-119187: node-forge TLS stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-119187-forge-also-called-node-forge-is-a-native-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-85393: node-forge RSA signature forgery via ASN.1 parsing bypass](https://junglewise.ai/threats/cve-2026-85393-node-forge-rsa-signature-forgery-via-asn-1-parsing-bypass) (high, CVSS 7.5, published 3 Sep 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 10 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## Digital Bazaar technologies - [Digital Bazaar Forge](https://junglewise.ai/threats/technologies/forge): 29 vulnerabilities - [Digital Bazaar Node-Forge](https://junglewise.ai/threats/technologies/digital-bazaar-node-forge): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Digital Bazaar vulnerabilities", https://junglewise.ai/threats/vendors/digital-bazaar, 11 November 2026.