Digitalbazaar

Forge

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2025-66030

  • EPSS 0.04%
  • Veröffentlicht 26.11.2025 22:23:41
  • Zuletzt bearbeitet 06.12.2025 00:20:44

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures contai...

7.5

CVE-2025-66031

  • EPSS 0.12%
  • Veröffentlicht 26.11.2025 22:23:26
  • Zuletzt bearbeitet 06.12.2025 00:22:18

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 struct...

8.6

CVE-2025-12816

Exploit
  • EPSS 0.06%
  • Veröffentlicht 25.11.2025 19:15:50
  • Zuletzt bearbeitet 02.01.2026 19:02:08

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cry...

7.5

CVE-2022-24771

  • EPSS 0.14%
  • Veröffentlicht 18.03.2022 14:15:10
  • Zuletzt bearbeitet 21.11.2024 06:51:03

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted...

7.5

CVE-2022-24772

  • EPSS 0.16%
  • Veröffentlicht 18.03.2022 14:15:10
  • Zuletzt bearbeitet 21.11.2024 06:51:03

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 st...

5.3

CVE-2022-24773

  • EPSS 0.13%
  • Veröffentlicht 18.03.2022 14:15:10
  • Zuletzt bearbeitet 21.11.2024 06:51:04

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lea...

6.1

CVE-2022-0122

Exploit
  • EPSS 0.16%
  • Veröffentlicht 06.01.2022 05:15:09
  • Zuletzt bearbeitet 21.11.2024 06:37:57

forge is vulnerable to URL Redirection to Untrusted Site

7.5

CVE-2020-7720

Exploit
  • EPSS 2.09%
  • Veröffentlicht 01.09.2020 10:15:10
  • Zuletzt bearbeitet 21.11.2024 05:37:40

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.