npm

node-forge

36 Total advisories

36 Vulnerabilities

0 Malware

Dependency scanning

Check whether node-forge is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

node-forge

Vulnerabilities

Forge: TLS client crash on a handshake record received without a session

Forge: TLS client crash on an unsupported ServerHello compression method

Forge: ReDoS in forge.http response header and cookie trimming

Forge: Ed25519 signature verification accepts small-order public keys

Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding

Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

Forge: Certificate signature verified with the issuer's RSA signature scheme

Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Forge: Denial of service in TLS record processing via call stack exhaustion

Forge: Regular expression denial of service in PEM decoding (pem.decode)

Forge: TLS client crash when the server sends no certificate

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

Forge: AES-GCM authentication bypass via unvalidated tagLength option

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

Forge has signature forgery in Ed25519 due to missing S > L check

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

node-forge is vulnerable to ASN.1 OID Integer Truncation

node-forge has ASN.1 Unbounded Recursion

Prototype Pollution in node-forge

Improper Verification of Cryptographic Signature in `node-forge`

Improper Verification of Cryptographic Signature in node-forge

Improper Verification of Cryptographic Signature in node-forge

Open Redirect in node-forge

Prototype Pollution in node-forge debug API.

Prototype Pollution in node-forge util.setPath API

URL parsing in node-forge could lead to undesired behavior.

Browse more npm advisories

Start Securing