Digitalbazaar Forge
12 CVEs affecting Digitalbazaar Forge. Latest disclosed: 2026-03-27. Critical: 1, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7720 | Critical | 9.8 | 2020-09-01 | The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the… |
CVE-2025-12816 | High | 8.6 | 2025-11-25 | An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desy… |
CVE-2026-33895 | High | 7.5 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification a… |
CVE-2026-33894 | High | 7.5 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature ver… |
CVE-2026-33891 | High | 7.5 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulner… |
CVE-2025-66031 | High | 7.5 | 2025-11-26 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge ve… |
CVE-2022-24772 | High | 7.5 | 2022-03-18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi… |
CVE-2022-24771 | High | 7.5 | 2022-03-18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi… |
CVE-2026-33896 | High | 7.4 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` d… |
CVE-2022-0122 | Medium | 6.1 | 2022-01-06 | forge is vulnerable to URL Redirection to Untrusted Site |
CVE-2025-66030 | Medium | 5.3 | 2025-11-26 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions… |
CVE-2022-24773 | Medium | 5.3 | 2022-03-18 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verifi… |