npm/node-forge

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Modified: 9/10/2026

Improper Verification of Cryptographic Signature in `node-forge`

Modified: 11/8/2023

node-forge has ASN.1 Unbounded Recursion

Modified: 9/10/2026

node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

Modified: 9/10/2026

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Modified: 9/10/2026

Prototype Pollution in node-forge debug API.

Modified: 1/7/2022

node-forge is vulnerable to ASN.1 OID Integer Truncation

Modified: 9/10/2026

node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

Modified: 10/1/2026

Open Redirect in node-forge

Modified: 11/8/2023

Prototype Pollution in node-forge

Modified: 1/14/2025

Improper Verification of Cryptographic Signature in node-forge

Modified: 11/8/2023

URL parsing in node-forge could lead to undesired behavior.

Modified: 1/7/2022

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Modified: 10/1/2026

Forge has signature forgery in Ed25519 due to missing S > L check

Modified: 9/10/2026

Prototype Pollution in node-forge util.setPath API

Modified: 1/7/2022

Improper Verification of Cryptographic Signature in node-forge

Modified: 11/8/2023