CVE-2026-118777: 
node-forge vulnerability analysis and mitigation

CVE-2026-118777 is a prototype pollution vulnerability in the forge.http client of node-forge (also known as Forge), a native JavaScript implementation of Transport Layer Security. A malicious server can exploit this flaw by sending crafted Set-Cookie response headers with reserved names such as __proto__ or constructor, causing attacker-controlled values to be written onto Object.prototype or the global Object. All versions of node-forge prior to 1.4.1 are affected; applications that do not use forge.http or forge.xhr are unaffected. The vulnerability was reported by @arunmozhivarman-dtx and @Dremig, published on October 27–29, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution). In lib/http.js, client.setCookie() stored cookies using client.cookies[cookie.name][cookie.path] = cookie, with existence checks performed via the in operator, which traverses the prototype chain. Because in sees inherited properties, a cookie named __proto__ caused client.cookies['__proto__'] to resolve to Object.prototype, and the cookie's path value was then written as a new property on Object.prototype, visible on every object in the JavaScript realm. Similarly, a cookie named constructor could add properties to the global Object function, and an empty cookie value triggered client.removeCookie() which used the same flawed in checks to delete Object.prototype properties (e.g., Set-Cookie: __proto__=; path=toLocaleString would delete Object.prototype.toLocaleString). The attack also bypassed the cookie's secure-flag and domain checks, making it exploitable over both http:// and https:// connections (GitHub Advisory, Fix Commit).

A malicious server can pollute Object.prototype for the entire JavaScript realm of the affected application, potentially altering application logic that reads properties from plain objects and breaking built-in Object.prototype methods (e.g., deleting toString or toLocaleString). This results in low integrity and low availability impacts — application behavior can be silently modified or the page/process can be crashed — with no direct confidentiality impact. Only applications using forge.http directly or through forge.xhr (included in the forge.all browser bundle) against untrusted servers are at risk (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The GitHub Security Advisory includes a minimal proof-of-concept demonstrating the attack via a crafted Set-Cookie header (Set-Cookie: __proto__=evil; path=polluted), but no weaponized exploit or exploit kit has been identified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or compromise a server that the victim application communicates with via forge.http, which raises the attack complexity (CVSS AC:H) (GitHub Advisory).

1. Identify a target: Locate an application that uses forge.http or forge.xhr (e.g., via the forge.all browser bundle) to communicate with a server the attacker controls or can perform a man-in-the-middle attack against.
2. Set up a malicious server: Configure the server to respond with a crafted Set-Cookie header, such as Set-Cookie: __proto__=evil; path=polluted, to add a property to Object.prototype, or Set-Cookie: constructor=evil; path=polluted to add a property to the global Object.
3. Trigger the client request: Cause the target application to make an HTTP request to the malicious server using forge.http.createClient() or forge.xhr.
4. Exploit prototype pollution: When the client processes the response, client.setCookie() writes the attacker-controlled path value onto Object.prototype (e.g., ({}).polluted becomes the cookie object for all plain objects in the realm).
5. Achieve impact: Leverage the polluted prototype to alter application logic (e.g., bypass property checks, override default behaviors) or delete critical Object.prototype methods (e.g., Set-Cookie: __proto__=; path=toLocaleString) to crash the application (GitHub Advisory, Fix Commit).

• Network: HTTP responses from external servers containing Set-Cookie headers with names __proto__, constructor, or other Object.prototype property names; responses with empty cookie values targeting prototype method names (e.g., path=toString, path=toLocaleString).
• Application Behavior: Unexpected JavaScript errors such as TypeError related to missing or overridden Object.prototype methods (e.g., toLocaleString is not a function); application logic behaving unexpectedly due to unexpected properties appearing on plain objects.
• Logs: Server access logs or proxy logs showing responses with unusual Set-Cookie header values containing __proto__ or constructor as the cookie name.

Upgrade node-forge to version 1.4.1, which fixes the issue by replacing in operator checks with Object.prototype.hasOwnProperty.call() (own-property checks) and explicitly rejecting cookies named __proto__ or with the path __proto__ (GitHub Release, Fix Commit). As a workaround for those unable to upgrade immediately, avoid using forge.http or forge.xhr with untrusted servers, or filter Set-Cookie headers with names matching __proto__, constructor, or other Object.prototype property names before they reach the client (GitHub Advisory).

The vulnerability was reported by security researchers @arunmozhivarman-dtx and @Dremig and addressed promptly by the node-forge maintainer (davidlehn) with a patch and regression tests. No significant broader media coverage or notable community debate has been identified beyond the GitHub Security Advisory (GitHub Advisory).