[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
node-forge	resolutions	patch	1.4.0 → 1.4.1

---

Release Notes

digitalbazaar/forge (node-forge)

v1.4.1

Compare Source

Notes

• This release involved coordinating many security reports from many groups,
  people, and robots over too long period of time. Thank you for your reports
  and patience.
• Claude Code was used to help organize, track, untangle, merge, test,
  validate, fix, and improve it all. Further verification of fixes would be
  welcome.
• Tracking credits was challenging for some issues due to multiple email and
  GitHub reports, incomplete contact details, or combining of partial reports
  and fixes. Please let us know if there are credits changes needed here or in
  advisory data.

Security

• HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field in
  DigestAlgorithm.
  • RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low
    public exponent keys (e=3). The fix for CVE-2026-33894 only checked the
    element count of the outer DigestInfo. Attackers can add "garbage" elements
    inside the nested DigestAlgorithm SEQUENCE in order to construct a
    signature that passes verification, enabling Bleichenbacher style forgery.
  • Reported by Geo (@​geo-chen).
  • CVE ID: CVE-2026-85393
  • GHSA ID: GHSA-2g46-22mc-6gwp
• HIGH: Signature forgery in RSA-PKCS due to non-canonical DigestInfo
  encoding.
  • RSASSA PKCS#1 v1.5 signature verification accepts non-canonical DigestInfo
    encodings, such as NULL parameters with content, non-minimal length
    encodings, and non-canonical OIDs. These provide attackers space to
    construct forged signatures for low public exponent keys (e=3), similar to
    CVE-2026-33894 and CVE-2026-85393.
  • Reported by Oren Yomtov (Fireblocks), Bronson Yen (Calif.io, in
    collaboration with Claude and Anthropic Research), Kamil Hałajda,
    @​pzartech, @​antonlissone, and @​Brechard.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-6qrw-m8cv-hcxf
• HIGH: ASN.1 resource exhaustion via BIT STRING decoding.
  • An Uncontrolled Recursion (CWE-674) and Uncontrolled Resource Consumption
    (CWE-400) vulnerability in node-forge versions 1.4.0 and below enables
    remote, unauthenticated attackers to exhaust CPU and memory with small
    crafted DER or PEM inputs (certificates, keys, and other structures parsed
    with asn1.fromDer()). By default fromDer() attempts to decode BIT
    STRING contents as ASN.1. That decode ignored the global asn1.maxDepth
    and the per-call maxDepth option, and BIT STRINGs nested in decoded BIT
    STRINGs were decoded too, with each level keeping a full copy of its
    decoded contents. Memory use grew quadratically with the nesting depth
    and can terminate the process from heap exhaustion. The maxDepth bypass
    is an incomplete fix of CVE-2025-66031.
  • Reported by:
    • Ethan Kim (cremit.io).
    • Youngjoon Kim (Georgia Tech SSLab).
    • @​arpitjain099.
    • Mike Read.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-rhr8-3pm8-cq29
• HIGH: Regular expression denial of service in PEM decoding.
  • An Inefficient Regular Expression Complexity (CWE-1333) vulnerability in
    node-forge versions 1.4.0 and below enables remote, unauthenticated
    attackers to block the event loop with small crafted inputs to
    pem.decode() and the APIs that parse PEM, such as
    pki.certificateFromPem() and pki.privateKeyFromPem(). The regular
    expression that splits PEM messages takes polynomial time on input
    without a matching END line; a 30 KB input took over 20 seconds. The
    regular expressions that parse encapsulated headers took quadratic time
    on long header lines.
  • Reported by:
    • Ahmed Mokhtari (@​AhmedMokhtari), @​mwlik, and @​imenyoo2.
    • @​offset.
    • @​bibu123456.
    • @​Mucahic.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-7wch-p9px-956x
• HIGH: Denial of service in TLS record processing via call stack
  exhaustion.
  • tls.createConnection() connections handle received records recursively:
    each record handler calls process() again for the next buffered record.
    A peer can send one chunk of many small records, such as heartbeat
    records, which are accepted in every state including before the
    handshake, and process() throws RangeError: Maximum call stack size exceeded. In Node.js applications that call process() from a socket
    data handler, the exception is uncaught and terminates the process.
    Server and client connections are affected, and no authentication is
    required.
  • Reported by:
    • Ziyue Wang, Chenchen, Strick Sheng, Liyi Zhou, and Maurice Ng.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-hqq3-7jhf-c5jx
• HIGH: Denial of service in TLS record processing via an interleaved
  record during a fragmented handshake message.
  • When a tls.createConnection() connection receives a record of another
    type (alert, change_cipher_spec, application data or heartbeat) while a
    handshake message is split across records, it reports the error and
    closes the connection, and then process() throws TypeError: Cannot set properties of null. A peer can trigger this with two small records
    before the handshake, without authentication, as a server or a client.
    In Node.js applications that call process() from a socket data
    handler, the exception is uncaught and terminates the process.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-8hrf-8g6f-7xwp
• HIGH: PKCS#12 MAC forgery due to missing iteration count check.
  • pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero
    from the input. With fewer than one iteration, the PKCS#12 key derivation
    function (RFC 7292 Appendix B.2) does no hashing and returns a constant key
    that does not depend on the password or salt. An attacker who does not know
    the password can modify the contents of a PKCS#12/PFX file, such as
    replacing certificates or keys, and compute a MAC that verifies with any
    password. The PKCS#12 password-based encryption schemes
    (pbeWithSHAAnd3-KeyTripleDES-CBC, pbewithSHAAnd40BitRC2-CBC) are
    affected the same way: with zero iterations they use a constant key and
    IV, so a substituted encrypted private key decrypts with any password.
  • Reported by Thai (Calif.io), in collaboration with Claude and Anthropic
    Research.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-jc66-7q78-782g
• HIGH: basicConstraints bypass via deprecated extension OIDs in
  certificate chain verification.
  • node-forge parses extensions with the deprecated OIDs 2.5.29.10 and
    2.5.29.13 as basicConstraints, and pki.verifyCertificateChain()
    used the first extension with that name. A certificate with a forged
    deprecated-OID extension (cA TRUE) before its genuine basicConstraints
    extension (cA FALSE) is accepted as a CA, and the same technique can
    hide a pathLenConstraint. An attacker who obtains such a certificate
    from a trusted CA that copies extensions from certificate requests can
    issue certificates for any name that node-forge accepts as valid.
  • Reported by @​nickcollisson-workos (WorkOS Security Team).
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-5x38-2vff-x55p
• MODERATE: Denial of service in the TLS client when the server sends no
  certificate.
  • A NULL Pointer Dereference (CWE-476) vulnerability in node-forge versions
    1.4.0 and below lets a malicious TLS server, or an on-path attacker who
    removes the server's Certificate message, crash applications that use the
    forge TLS client. The client's check for a missing server certificate
    read the wrong property and never ran, so the handshake continued and
    connection.process() threw a TypeError instead of failing the
    connection.
  • Reported by @​arpitjain099.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-525v-9gp9-w22h
• MODERATE: pathLenConstraint bypass in certificate chain verification.
  • pki.verifyCertificateChain() only enforces the basicConstraints
pathLenConstraint of a CA certificate when that certificate also has a
    keyUsage extension. When a CA certificate with a pathLenConstraint
    lacks keyUsage, chains with more intermediate CA certificates below it
    than the constraint allows are accepted. The holder of such a constrained
    CA's key, or anyone it issues a CA certificate to, can create subordinate
    CAs whose certificates node-forge accepts as valid.
  • Reported by @​offset, @​eddieran, Zion Boggan, and SongWriterOP GT.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-h46v-rmh6-fq4f
• MODERATE: AES-GCM authentication bypass with an invalid tag length.
  • GCM mode does not validate the tagLength option. With a tagLength of
    0 (or null, false, '', or '0'), the computed authentication tag is
    empty, and decryption with an empty or missing tag succeeds:
    decipher.finish() returns true for any ciphertext and additional data.
    An attacker can then forge or modify messages that the application accepts
    as authentic. This requires the application to pass such a tagLength,
    for example one derived from the length of a received tag. The default
    tag length of 128 bits is not affected.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-5cwg-6vw7-rj6p
• MODERATE: Prototype pollution via Set-Cookie in forge.http.
  • A Prototype Pollution (CWE-1321) vulnerability in node-forge versions
    1.4.0 and below lets a malicious server add properties to
    Object.prototype and Object, or delete Object.prototype
    properties, in applications that use the forge.http client (included
    in the forge.all browser bundle, not loaded by require('node-forge')).
    Cookie names and paths from Set-Cookie headers were used as keys of a
    plain object with in checks, so __proto__ and inherited names
    reached Object.prototype.
  • Reported by @​arunmozhivarman-dtx and @​Dremig.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-6wvx-3r32-xmcg
• LOW: ASN.1 OID first arc truncation.
  • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.4.0
    and below lets asn1.oidToDer() encode an OID string with out of range
    first arcs as a different OID, e.g. 0.42.840.113549.1.1.1 or
    4294977127.18.840.113549.1.1.1 as rsaEncryption
    (1.2.840.113549.1.1.1), which can bypass OID-based decisions made on
    the string. The fix for CVE-2025-66030 only checked the later arcs.
  • Reported by wzc.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-4642-5mcj-2rqw
• LOW: Certificate signature verified with the issuer's signature scheme.
  • An Improper Verification of Cryptographic Signature (CWE-347)
    vulnerability in node-forge versions 1.4.0 and below lets a certificate
    labeled as signed with RSASSA-PSS pass chain verification with a PKCS#1
    v1.5 signature. certificate.verify(child) and verifyCertificateChain()
    chose the RSA padding scheme and PSS parameters from the issuer
    certificate instead of the child certificate. The signature must still
    be made with the issuer's key, so this only misleads applications that
    rely on a certificate's signature algorithm.
  • Reported by Brian Lee (Georgia Tech SSLab, Team Atlanta).
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-9wg5-mj3p-v49q
• LOW: Incomplete PKCS#7 padding validation in CBC and ECB decryption.
  • An Improper Validation of Integrity Check Value (CWE-354) vulnerability in
    node-forge versions 1.4.0 and below makes decipher.finish() accept
    malformed padding in CBC and ECB mode. Only the last byte was checked,
    against a limit of four blocks, so mismatched padding bytes, a zero count
    and counts larger than a block were accepted, and up to four blocks of
    plaintext could be removed. CBC and ECB without a MAC never provide
    integrity, and this fix doesn't change that; use AES-GCM or authenticate
    the ciphertext.
  • Reported by Oren Yomtov (Fireblocks), @​zebbern, and Brian Lee (Georgia
    Tech SSLab, Team Atlanta).
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-2vgq-wchc-25w7
• LOW: Certificate chain verification removes trusted certificates from
  the CA store.
  • When a CA store created with pki.createCaStore() holds two or more
    certificates with the same subject name, pki.verifyCertificateChain()
    permanently removes certificates with that subject from the store while
    looking for the issuer of a certificate. A peer that sends a certificate
    naming that subject as its issuer, even one with an invalid signature,
    makes all later verifications of chains issued by those CA certificates
    fail, for as long as the store is in use. Verifying valid chains has the
    same effect. Verification never incorrectly succeeds because of this.
  • Reported by @​pravichandran15.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-4487-j8r4-4g2f
• LOW: Denial of Service in BigInteger.modInverse() with negative inputs.
  • The 1.4.0 fix for CVE-2026-33891 only handled a zero input.
    BigInteger.modInverse() still enters an infinite loop when the value or
    the modulus is negative, causing the process to hang indefinitely and
    consume 100% CPU. In forge this is reachable when a negative public
    exponent e is passed to pki.rsa.generateKeyPair() or
    pki.rsa.createKeyPairGenerationState(). Keys parsed from DER, PEM or JWK
    cannot produce negative values. Applications are affected only if they
    pass untrusted values as the RSA key generation exponent or call
    modInverse() with negative values.
  • Reported by wzc.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-h6cr-wjv9-3cpp

Fixed

• [rsa] Require a canonical DER DigestInfo in RSASSA PKCS#1 v1.5 signature
  verification by re-encoding the expected DigestInfo and comparing bytes, as
  in RFC 8017 8.2.2. Based on work in PRs by @​matthewscottconroy (#​1159),
  @​shaswata56 (#​1160), @​nitrog7 (#​1161), and @​RoastFried-RF (#​1162).
• [asn1] Apply the fromDer() maxDepth recursion limit when decoding ASN.1
  from BIT STRING contents. Contents that would exceed the limit are kept as
  an undecoded BIT STRING value.
• [asn1] Only decode one level of BIT STRING contents in fromDer(). BIT
  STRINGs inside decoded BIT STRING contents are kept as undecoded BIT STRING
  values. Their bytes are unchanged by toDer().
  • NOTE: Code that relied on nested BIT STRING decoding needs to decode
    the inner BIT STRING value (after its leading unused bits octet) with
    asn1.fromDer(). Common structures such as SubjectPublicKeyInfo only use
    one level.
• [pem] Find PEM messages and parse encapsulated headers in linear time.
  Messages are matched as before, except that a BEGIN line's label is the
  shortest one followed by ----- (RFC 7468 labels can't contain --).
• [asn1] Reject OIDs whose first arc isn't 0, 1 or 2, or whose second arc is
  over 39 under 0 or 1, in asn1.oidToDer().
• [asn1] Encode and decode a multi-byte first OID subidentifier (e.g.
  2.999) in base 128. From PR #​1148 by @​spokodev.
• [tls] Process received TLS records in a loop instead of recursively, so the
  number of records in one process() call no longer affects stack depth.
• [tls] Stop processing a record that interrupts a fragmented handshake
  message after failing the connection with an unexpected_message alert,
  instead of throwing a TypeError.
• [tls] Fail the TLS client handshake with an insufficient_security alert
  when the server sends no certificate, even if the verify callback
  accepts it, since the RSA key exchange needs the server certificate.
• [pkcs12] Reject PKCS#12 MAC iteration counts less than one.
• [pbe] Reject iteration counts less than one in the PKCS#12 key derivation
  function pbe.generatePkcs12Key() (also pkcs12.generateKey()), used for
  PKCS#12 MACs and PKCS#12 password-based encryption.
• [x509] Use only the RFC 5280 basicConstraints OID (2.5.29.19) in
  certificate chain verification, not the deprecated OIDs that are also
  parsed as basicConstraints.
• [x509] Enforce basicConstraints pathLenConstraint in chain verification
  for CA certificates without a keyUsage extension.
• [x509] Verify a certificate's signature with the padding scheme and
  parameters of its own signature algorithm, using the issuer's public key.
  PKCS#1 v1.5 certificates issued by an RSASSA-PSS certificate, and the
  reverse, failed verification before.
• [cipher] Validate the GCM tagLength option. Only the tag lengths defined by
  NIST SP 800-38D (128, 120, 112, 104, 96, 64, and 32 bits) are allowed;
  numeric strings such as '128' are still accepted. A null or undefined
tagLength uses the default of 128 bits.
  • NOTE: Zero and other invalid tag lengths (such as 0, false, '',
    8, or 256), which produced empty or non-conformant tags, now throw an
    error. A null or undefined tagLength, which produced an empty tag
    when encrypting, now means the default of 128 bits. Data previously
    encrypted with an empty tag can no longer be decrypted, since accepting
    an empty tag is the authentication bypass.
• [cipher] Require valid PKCS#7 padding when decrypting in CBC and ECB mode:
  a count from 1 to the block size, and every padding byte equal to the
  count.
  • NOTE: Data with other padding, such as ANSI X.923, ISO 10126 or
    XML Encryption padding, used to decrypt because only the last byte was
    checked, and now fails. To decrypt it, set decipher.mode.unpad = false
    before finish() and remove the padding in your code.
• [http] Only use own properties of the cookie store, and ignore cookies
  named __proto__ or with the path __proto__.
• [x509] Do not modify the CA store's list of certificates with the same
  subject when trying each of them as the issuer in
  pki.verifyCertificateChain().
• [jsbn] Fix BigInteger.modInverse to also exit early with zero when the
  target object value or the modulus is negative, completing the 1.4.0 fix
  that only checked for zero.
• [tls] Ignore heartbeat requests received before the first handshake is
  complete, instead of answering them. Previously, unauthenticated peers
  could make a connection create and send a heartbeat response for every
  request before the handshake, at a significant CPU cost per request.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

Summary by CodeRabbit

• Chores
  • Updated a supporting component to a newer version. No user-facing changes are noted in this update.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T05:14:32.836785Z	5f1bb06	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4e97ff08-2cee-421b-ac6d-eca558741385

Commits

Reviewing files that changed from the base of the PR and between 18fbb71 and 5f1bb06.

Files ignored due to path filters: 1

• docs/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

Files selected for processing: 1

• docs/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The node-forge resolution in docs/package.json changes from version 1.4.0 to 1.4.1.

Changes: Documentation dependency update

Layer / File(s)	Summary
Update node-forge resolution docs/package.json	The resolved node-forge version changes from 1.4.0 to 1.4.1.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related issues

• Issue 403 identifies node-forge 1.4.1 as an open dependency update, matching this change.

Merge Risk: Minimal · up to 5f1bb

No actionable issue remains for this dependency-only update.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the dependency update from node-forge 1.4.0 to 1.4.1.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checked the package list,
And found a newer forge in sight.
One version hopped from four to five,
The docs now point to one-four-one.
Then off it bounced beneath the moon.}

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] This PR appears safe to merge; no actionable issues were found.

Summary

Updates the docs node-forge resolution from 1.4.0 to 1.4.1.

• The docs site now installs node-forge 1.4.1.

_{Reviews (1) · Last reviewed commit: "chore(deps): update dependency node-forg..." · Reviewed by Greptile}