Zero Radar
← feed
HighVulnerabilityCVE-2026-118779updated 30 Oct 2026, 23:03 UTC

node-forge can freeze when parsing crafted PEM text

Someone can send a specially crafted certificate or key text that makes a Node.js app hang for a long time while it tries to read it. This is a denial-of-service issue: the app stops responding but no data is stolen.

Fixed in node-forge 1.4.1 · out Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesnode-forge 1.4.1 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends PEMMalformed input with no matching END line
  2. 2App parses inputCalls node-forge PEM parsing API
  3. 3Event loop blockedRegex takes polynomial time on input
  4. 4Service unresponsiveOther requests wait for seconds to minutes
  5. ResultApplication becomes unresponsive (denial of service)

What happened

Regular expressions in node-forge's pem.decode() take polynomial time on malformed PEM input, including input missing an END line, and quadratic time on long encapsulated header lines, blocking the Node.js event loop.

Why it is dangerous: A remote attacker can make the app unresponsive for seconds to minutes with a payload of a few tens of kilobytes, affecting any service that parses untrusted PEM data with node-forge.

Are you affected?

You are affected if your application uses node-forge version 1.4.0 or earlier and passes untrusted PEM input to APIs such as pki.certificateFromPem, pki.privateKeyFromPem, pki.publicKeyFromPem, pki.certificationRequestFromPem, pki.encryptedPrivateKeyFromPem, pki.decryptRsaPrivateKey or pkcs7.messageFromPem.

Package / productAffected versionsFixed in
node-forge · npm<= 1.4.01.4.1

What to do

  1. Update node-forge to 1.4.1 or later in every project that uses it, including transitive dependencies
  2. Verify the installed version with npm ls node-forge and rebuild/redeploy
  3. Until updated, reject untrusted PEM input larger than a few kilobytes before passing it to node-forge (this only limits the delay)

Timeline

  1. 29 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 19:21 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:03 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 23:03 UTC
    Fixed version published: node-forge 1.4.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118779 · GHSA-7wch-p9px-956x
CVSS
7.5 / 10
Disclosed
29 Oct 2026, 19:17 UTC
On Zero Radar
29 Oct 2026, 19:21 UTC (4 min after disclosure)
Last change
30 Oct 2026, 23:03 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

node-forge can freeze when parsing crafted PEM text · Zero Radar