CVE-2026-119191: Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

Published Oct 29, 2026

Updated

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade node-forge to a version that resolves this vulnerability.
Fixed in 1.4.1

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it if they can cause an affected application to pass attacker-controlled DER data to asn1.fromDer(). The crafted input uses nested BIT STRING values.

Are applications using a maxDepth limit protected?

Not reliably in affected versions. BIT STRING decoding did not consistently apply the configured maxDepth limit, allowing nested data to trigger excessive recursion and resource consumption.

What is the impact of successful exploitation?

Processing malicious DER can cause excessive recursion and CPU use, along with quadratic memory consumption. This can result in denial of service.

What should teams do if they cannot upgrade immediately?

Restrict or reject untrusted DER input before it reaches asn1.fromDer(), especially inputs that may contain deeply nested BIT STRING values. The provided data identifies version 1.4.1 as the fix.