CVE-2026-125333

Name of the Vulnerable Software and Affected Versions Forge versions 0.1.2 through 1.4.2

Description In the forge.http module, the trimString() function in lib/http.js uses a regular expression to remove trailing whitespace from response header values and cookie names and values. This regular expression can take quadratic time when processing a long sequence of whitespace followed by a non-whitespace character. A malicious server or an on-path attacker can exploit this by providing a specially crafted response header, causing the response.readHeader() or response.getCookies() functions to repeatedly scan the input. This results in a Regular Expression Denial of Service (ReDoS), which blocks the Node.js event loop or the browser tab for several minutes. This issue specifically affects applications using forge.http with a socket pool to communicate with untrusted servers.

Recommendations Update Forge to version 1.4.3. As a temporary mitigation, limit the size of HTTP response headers in the socket pool's data handler before they are passed to forge.http.