CVE-2026-119186: fallo de gravedad media en digitalbazaar forge
Forge: AES-GCM authentication bypass via unvalidated tagLength option
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.2%
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
digitalbazaar · forgeCVEs relacionadas — digitalbazaar forge
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-24772HIGHImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.1%CVE-2022-24773MEDIUMImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.0%CVE-2022-24771HIGHImproper Verification of Cryptographic Signature in node-forgeEPSS 0.8%CVE-2026-33891HIGHForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputEPSS 0.6%CVE-2026-118779HIGHForge: Regular expression denial of service in PEM decoding (pem.decode)EPSS 0.6%CVE-2026-33895HIGHForge has signature forgery in Ed25519 due to missing S > L checkEPSS 0.5%