CVE-2026-119191: Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
Vulnerability summary
CVE-2026-119191 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in digitalbazaar forge. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 29-10-2026PublishedVulnerability first disclosed.
Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundForge
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Digitalbazaar1 product
- forge< 1.4.1
Ubuntu1 product
- node-node-forgeAll versions (No fix recorded)
2 vendors · 2 products
References
6 links- github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29X Refsource CONFIRMExploitMitigationVendor AdvisoryREPORT
- github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4bX Refsource MISCPatchREPORT
- github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7X Refsource MISCPatchREPORT