CVE-2026-118779

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1

Description An unauthenticated attacker can cause a denial of service by supplying a long malformed PEM message to any high-level parser. This occurs because the pem.decode() function in lib/pem.js uses polynomial-time regular expressions when parsing encapsulated headers and searching for a matching END line, leading to excessive CPU consumption.

Recommendations Update Forge to version 1.4.1.