Digitalbazaar

14 CVEs across 3 Digitalbazaar products. Browse Digitalbazaar vulnerabilities, severities, and proof-of-concept exploits.

Digitalbazaar products with known CVEs

ProductCVEs
Forge13
Digitalbazaar/forge1
Zcap1
Digitalbazaar CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-85393High7.52026-09-03node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed…
CVE-2026-33896High7.42026-03-27Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` d…
CVE-2026-33895High7.52026-03-27Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification a…
CVE-2026-33894High7.52026-03-27Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature ver…
CVE-2026-33891High7.52026-03-27Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulner…
CVE-2025-66031High7.52025-11-26Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge ve…
CVE-2025-66030Medium5.32025-11-26Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions…
CVE-2025-12816High8.62025-11-25An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desy…
CVE-2024-31995Medium4.32024-04-10`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a ch…
CVE-2022-24773Medium5.32022-03-18Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi…
CVE-2022-24772High7.52022-03-18Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi…
CVE-2022-24771High7.52022-03-18Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi…
CVE-2022-0122Medium6.12022-01-06forge is vulnerable to URL Redirection to Untrusted Site
CVE-2020-7720Critical9.82020-09-01The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the…