CVE-2026-119191

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1

Description Forge (also known as node-forge) is a native JavaScript implementation of Transport Layer Security. The asn1.fromDer() function fails to consistently apply the maxDepth limit when decoding ASN.1 data stored within BIT STRING values, recursively retaining copies at each nesting level. An attacker can provide a specially crafted DER (Distinguished Encoding Rules) containing nested BIT STRINGs to trigger excessive recursion, high CPU utilization, and quadratic memory consumption.

Recommendations Update Forge to version 1.4.1.