CVE-2026-125333: Forge: ReDoS in forge.http response header and cookie trimming
forge.http trims response header and Set-Cookie values with the regular expression /\s$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forge 1.4.3.
Details trimString() in lib/http.js removes trailing whitespace with str.replace(/\s$/, ''). On a string of n whitespace characters followed by a non-whitespace character, the regular expression engine tries a match at each of the n positions and scans the rest of the run each time, so the work is O(n^2). forge.http calls trimString() on every response header value read by response.readHeader(), and again on cookie names and values in response.getCookies(). There is no limit on header size.
With Node.js 24, an 80 KB header value takes about 4 seconds to parse, and 1 MB about 10 minutes, during which the event loop (or browser tab) is blocked.
forge.http is not loaded by require('node-forge'). It is part of the forge.all bundle and needs a socket pool provided by the application (historically Flash sockets via forge.xhr), so few applications use it.
The fix trims trailing whitespace with a loop, as lib/pem.js has done since 1.4.1. The trimmed result is unchanged.
Patches Fixed in node-forge 1.4.3.
Workarounds Limit the size of HTTP response headers before passing them to forge.http, for example in the socket pool's data handler.
Resources - Related: GHSA-7wch-p9px-956x (ReDoS in PEM decoding, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x
Severity CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate) CVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2) CVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.
Credits Reported by @manus-pi.
Proof of concept var response = forge.http.createResponse(); var ws = new Array(40001).join('\t '); response.readHeader(forge.util.createBuffer( 'HTTP/1.1 200 OK\r\nX-A: a' + ws + 'X\r\n\r\n')); // <= 1.4.2: about 4 seconds (quadratic in the whitespace length) // 1.4.3: about 1 ms
Regression tests are in tests/security/ghsa-6cv4-p8m7-4r25.js.
Impact Applications that use forge.http to talk to servers they don't control are affected. The server, or an on-path attacker, can send a response header that blocks the client's event loop for minutes, denying service to everything else in the process. There is no confidentiality or integrity impact.
Other sources
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take quadratic time. A malicious server or on-path attacker can supply a long whitespace run followed by a non-whitespace character in a response header, causing response.readHeader() or response.getCookies() to repeatedly scan the input and block the Node.js event loop or browser tab for minutes. Applications are affected only when they use forge.http with a socket pool to communicate with an untrusted server; forge.http is not loaded by require('node-forge'), and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3 - Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3 - Compensating control
Limit the size of HTTP response headers before passing them to forge.http, for example in the socket pool's data handler.
Event History
Frequently Asked Questions
Which deployments are affected?
Applications are affected only if they use forge.http with a socket pool to communicate with an untrusted server. Simply requiring node-forge does not load forge.http.
What must an attacker be able to do?
An attacker must control a server the application connects to, or be positioned on the network path, and supply a response header containing a long whitespace sequence followed by a non-whitespace character.
What is the operational impact of exploitation?
Processing the crafted header or cookies can cause response.readHeader() or response.getCookies() to repeatedly scan the input. This can block a Node.js event loop or browser tab for minutes; the issue has no confidentiality or integrity impact.
How can I remediate this issue?
Upgrade Forge to version 1.4.3, which fixes the issue. Versions from 0.1.2 until 1.4.3 are affected when the required forge.http socket-pool and untrusted-server conditions apply.