{"id":"EM-20261110-6LL3","url":"https://cyber.eventmonitor.net/incident/EM-20261110-6LL3/forge-vulnerability-cve-2026-119191/","type":"cve","title":"Forge Vulnerability (CVE-2026-119191)","subtitle":"CVE-2026-119191","subject":"CVE-2026-119191","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-10T15:57:41.000Z","firstSignal":"2026-10-29T20:17:30.197Z","lastSignal":"2026-11-10T15:57:41.000Z","updated":"2026-11-10T16:07:51.148Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T15:57:41.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-10T15:57:41.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-29T20:17:30.197Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-10T15:57:41.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261110-6LL3 created."}],"stages":[{"name":"Disclosed","at":"2026-10-29T20:17:30.197Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-29T20:17:30.197Z","detail":"CVSS 7.5 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-29T20:17:30.197Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-119191 (CVSS 7.5)","text":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119191"},{"at":"2026-11-10T15:57:41.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-rhr8-3pm8-cq29 / CVE-2026-119191: Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer","text":"npm:node-forge","url":"https://github.com/advisories/GHSA-rhr8-3pm8-cq29"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-29T20:17:30.197","score":7.5,"severity":"HIGH","desc":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING…","product":"Digitalbazaar Forge","seen":1793803438877},"kev":null,"epss":{"epss":0.00429,"pct":0.3726,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}