UBUNTU-CVE-2026-125333: Medium severity ubuntu/node-node-forge vulnerability
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take quadratic time. A malicious server or on-path attacker can supply a long whitespace run followed by a non-whitespace character in a response header, causing response.readHeader() or response.getCookies() to repeatedly scan the input and block the Node.js event loop or browser tab for minutes. Applications are affected only when they use forge.http with a socket pool to communicate with an untrusted server; forge.http is not loaded by require('node-forge'), and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
Which deployments are actually exposed to this denial-of-service issue?
Applications are affected only if they use forge.http with a socket pool to communicate with an untrusted server. Simply installing node-forge or loading it with require('node-forge') does not load forge.http.
What must an attacker be able to do to trigger the problem?
An attacker must control a server contacted by the application, or be on-path to modify its responses. They can send a response header containing a long run of whitespace followed by a non-whitespace character, causing header or cookie parsing to block the Node.js event loop or browser tab.
Does this issue expose or alter transmitted data?
No. The provided information states that the issue has no confidentiality or integrity impact; its effect is denial of service through prolonged processing.
What version fixes the issue?
The issue is fixed in node-forge version 1.4.3.