CVE-2026-119186

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1

Description Forge (also known as node-forge) fails to validate the tagLength option passed to the start() function during decryption via forge.cipher.createDecipher(). If an application uses a tagLength derived from received data or a zero-like configuration value, it can lead to a situation where an empty or missing authentication tag results in the decipher.finish() function accepting unauthenticated ciphertext.

Recommendations Update Forge to version 1.4.1. As a temporary mitigation, avoid deriving the tagLength parameter from received data and use a fixed valid tag length.