CLEANSTART-2026-DQ82377: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript

Q: What does an attacker need to exploit this issue?

The supplied severity vector indicates network-based exploitation with low attack complexity. It does not require prior privileges or user interaction.

Q: What is the expected security impact?

The severity vector rates integrity impact as high. It indicates no confidentiality or availability impact and an unchanged scope.

Q: How can I determine whether my deployment is affected?

The advisory identifies cleanstart/argo-workflows as the affected software. It does not provide affected or fixed version ranges, configuration prerequisites, or detection indicators.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.0.15-r2

4.0.15-r2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r2

Event History

Nov 11, 2026

Advisory Published

via OSV·12:41 AM

Data Sourced

via OSV·12:41 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-33895

Frequently Asked Questions

What does an attacker need to exploit this issue?

The supplied severity vector indicates network-based exploitation with low attack complexity. It does not require prior privileges or user interaction.

What is the expected security impact?

The severity vector rates integrity impact as high. It indicates no confidentiality or availability impact and an unchanged scope.

How can I determine whether my deployment is affected?

The advisory identifies cleanstart/argo-workflows as the affected software. It does not provide affected or fixed version ranges, configuration prerequisites, or detection indicators.

CLEANSTART-2026-DQ82377: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

How can I determine whether my deployment is affected?