digitalbazaar
6 records · 6 with a public proof-of-concept
Disclosed vulnerabilities where the NVD names digitalbazaar as an affected vendor, highest CVSS first.
- HIGH 7.5CVE-2026-119191public PoC
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge d…
forge
- HIGH 7.5CVE-2026-119187public PoC
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decis…
forge
- MEDIUM 4.8CVE-2026-118777public PoC
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could u…
forge
- LOW 3.7CVE-2026-118776public PoC
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-…
forge
- LOW 3.7CVE-2026-118775public PoC
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked …
forge
- LOW 3.7CVE-2026-118774public PoC
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input or security decision.…
forge