{"id":"EUVD-2026-113337","enisaUuid":"9dfe2e06-ed36-39f8-9a52-55a91adae494","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.","datePublished":"Oct 29, 2026, 6:45:55 PM","dateUpdated":"Oct 29, 2026, 8:23:11 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x\nhttps://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.1\n","aliases":"CVE-2026-118779\nGHSA-7wch-p9px-956x\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"859af160-f99c-3e23-8978-d6fa3130a34f","product":{"name":"forge","vendor":{"name":"digitalbazaar"}},"product_version":"\u003c 1.4.1"}],"enisaIdVendor":[{"id":"375096be-80b5-3132-a148-1d1771ce18d4","vendor":{"name":"digitalbazaar"}}],"enisaIdVulnerability":[{"id":"293a373c-b41b-3960-89fa-fe428c7a297b","vulnerability":{"id":"GHSA-7wch-p9px-956x","description":"Forge: Regular expression denial of service in PEM decoding (pem.decode)","datePublished":"Oct 30, 2026, 11:02:25 PM","dateUpdated":"Oct 30, 2026, 11:02:25 PM","baseScore":0.0,"references":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118779\nhttps://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3\nhttps://github.com/digitalbazaar/forge\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.1\n","enisa_id":"EUVD-2026-113337\n","aliases":"GHSA-7wch-p9px-956x\nCVE-2026-118779\n","epss":0.0,"dataProcessed":"Nov 3, 2026, 7:03:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6efd06f2-ae35-37a6-848f-23eab8cf9f55","vulnerability":{"id":"CVE-2026-118779","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.","datePublished":"Oct 29, 2026, 6:45:55 PM","dateUpdated":"Oct 29, 2026, 8:23:11 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x\nhttps://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.1\n","enisa_id":"EUVD-2026-113337\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Nov 3, 2026, 7:15:49 AM","vulnerabilityProduct":[{"id":"b7f4ea7f-9418-3fdd-8574-5ed179a584e8","product":{"name":"forge","vendor":{"name":"digitalbazaar"}},"product_version":"\u003c 1.4.1"}],"vulnerabilityVendor":[{"id":"a91109a8-5717-30e6-9191-b2ed59de51d6","vendor":{"name":"digitalbazaar"}}]}}],"enisaIdAdvisory":[]}