Digitalbazaar
Digitalbazaar Forge: vulnerabilidades y CVE
Digitalbazaar Forge tiene 12 vulnerabilidades publicadas, 7 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses7
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-33896 | Crítica (9.1) | 0.50% | — | 27 mar 2026 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when… |
| CVE-2026-33895 | Alta (7.5) | 0.47% | — | 27 mar 2026 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is… |
| CVE-2026-33894 | Alta (7.5) | 0.45% | — | 27 mar 2026 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent… |
| CVE-2026-33891 | Alta (7.5) | 0.90% | — | 27 mar 2026 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite… |
| CVE-2025-66031 | Alta (8.7) | 0.43% | — | 26 nov 2025 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated… |
| CVE-2025-66030 | Media (6.3) | 0.32% | — | 26 nov 2025 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers… |
| CVE-2025-12816 | Alta (8.6) | 0.74% | — | 25 nov 2025 | An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence… |
| CVE-2022-24773 | Media (5.3) | 0.96% | — | 18 mar 2022 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a… |
| CVE-2022-24772 | Alta (7.5) | 1.1% | — | 18 mar 2022 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after… |
| CVE-2022-24771 | Alta (7.5) | 0.78% | — | 18 mar 2022 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm… |
| CVE-2022-0122 | Media (6.1) | 0.84% | — | 6 ene 2022 | forge is vulnerable to URL Redirection to Untrusted Site |
| CVE-2020-7720 | Alta (7.3) | 3.2% | — | 1 sept 2020 | The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions. |