[ Vendor · 15 CVEs ]
digitalbazaar
CVEs affecting digitalbazaar published in the last 30 days, plus any digitalbazaar CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-119190 | 29 Oct 2026 | CVSS 7.4 | Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated… | Fix |
| CVE-2026-119191 | 29 Oct 2026 | CVSS 7.5 | digitalbazaar forgeForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |
| CVE-2026-119186 | 29 Oct 2026 | CVSS 5.9 | Forge: AES-GCM authentication bypass via unvalidated tagLength optionForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the… | Fix |
| CVE-2026-119187 | 29 Oct 2026 | CVSS 7.5 | Forge: Denial of service in TLS record processing via call stack exhaustionForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |
| CVE-2026-119188 | 29 Oct 2026 | CVSS 7.5 | Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |
| CVE-2026-119189 | 29 Oct 2026 | CVSS 5.9 | digitalbazaar forgeForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA… | |
| CVE-2026-118775 | 29 Oct 2026 | CVSS 5.3 | Forge: ASN.1 OID first arc truncation in asn1.oidToDerForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js… | Fix |
| CVE-2026-118776 | 29 Oct 2026 | CVSS 5.3 | digitalbazaar forgeForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |
| CVE-2026-118777 | 29 Oct 2026 | CVSS 6.5 | Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored… | Fix |
| CVE-2026-118778 | 29 Oct 2026 | CVSS 5.9 | Forge: TLS client crash when the server sends no certificateForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |
| CVE-2026-118779 | 29 Oct 2026 | CVSS 7.5 | Forge: Regular expression denial of service in PEM decoding (pem.decode)Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |
| CVE-2026-118780 | 29 Oct 2026 | CVSS 3.7 | Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |
| CVE-2026-118781 | 29 Oct 2026 | CVSS 2.9 | Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |
| CVE-2026-118782 | 29 Oct 2026 | CVSS 7.5 | Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12… | Fix |
| CVE-2026-118774 | 29 Oct 2026 | CVSS 5.3 | digitalbazaar forgeForge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used… | Fix |