CVE-2022-24772: digitalbazaar forge

EPSS trend

Probability

1.10%

Chance of exploitation in the next 30 days

Percentile

65%

Versus all other CVEs

30-day change

0.00 pp

From 1.10% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.10%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

8 links

github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1X Refsource MISCREPORTWEBPatchThird Party Advisory
github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2X Refsource MISCREPORTWEBPatchThird Party Advisory
github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434gX Refsource CONFIRMREPORTWEBThird Party Advisory
ubuntu.com/security/CVE-2022-24772REPORT
www.cve.org/CVERecord?id=CVE-2022-24772REPORT
security-tracker.debian.org/tracker/CVE-2022-24772Advisory
nvd.nist.gov/vuln/detail/CVE-2022-24772Advisory
github.com/digitalbazaar/forgePACKAGE

Related vulnerabilities

CVE-2025-66031chainguardarangodb-3.11+1840.43%10mo ago26-11-2025 22:23Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.CVE-2025-66030chainguardarangodb-3.11+1840.32%10mo ago26-11-2025 22:23Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.CVE-2025-12816chainguardarangodb-3.11+1860.74%10mo ago25-11-2025 19:15An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.CVE-2020-7720debiannode-node-forge+33.19%6y ago01-09-2020 09:35The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.CVE-2022-0122digitalbazaardigitalbazaar/forge+20.84%4y ago06-01-2022 05:00forge is vulnerable to URL Redirection to Untrusted Site CVE-2022-24771debiannode-node-forge+30.78%4y ago18-03-2022 13:25Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

All vulnerabilities inforge

CVE-2022-24772: digitalbazaar forge

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References