CVE-2026-119191: 
node-forge vulnerability analysis and mitigation

CVE-2026-119191 is an ASN.1 resource exhaustion vulnerability in node-forge (also called Forge), a native JavaScript implementation of Transport Layer Security. The flaw exists in the asn1.fromDer() function, which fails to consistently apply the configured maxDepth recursion limit when decoding ASN.1 structures nested inside BIT STRING values, and additionally decodes nested BIT STRINGs recursively while retaining full copies at each level — causing quadratic memory consumption. All versions up to and including 1.4.0 are affected; the issue is fixed in version 1.4.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory). This vulnerability is also an incomplete fix of the prior CVE-2025-66031 (GHSA-554w-wpv2-vw27), which addressed unbounded ASN.1 recursion in version 1.3.2 (GitHub Advisory).

The root cause involves two distinct flaws in lib/asn1.js (CWE-674: Uncontrolled Recursion; CWE-400: Uncontrolled Resource Consumption). First, when _fromDer() initiates BIT STRING content decoding, it creates a new options object {strict: true, decodeBitStrings: true} that omits maxDepth, so the depth check compares against undefined and never triggers — bypassing both the global asn1.maxDepth (default 256) and any per-call maxDepth option. Second, BIT STRINGs nested inside already-decoded BIT STRING contents are also decoded, and asn1.create() deep-copies the decoded contents at each nesting level (used by toDer() for change detection), causing memory growth quadratic in nesting depth. An attacker can exploit this by supplying crafted DER or PEM input — such as a certificate, public key, PKCS#7/8/12 structure, or TLS server certificate — containing deeply nested primitive BIT STRINGs to any API that calls asn1.fromDer() with default options, including pki.certificateFromPem(), pki.publicKeyFromPem(), and the forge TLS client (GitHub Advisory, Patch Commit).

Successful exploitation results in denial of service with no confidentiality or integrity impact. A remote, unauthenticated attacker can send a small crafted DER or PEM payload — as little as ~10 KB — to trigger excessive CPU consumption and memory exhaustion; on Node.js 24, a 10 KB input consumed approximately 600 MB and a 25 KB input approximately 1.4 GB. Inputs of approximately 200 KB can trigger a fatal FATAL ERROR: JavaScript heap out of memory abort that the application cannot catch, effectively crashing the Node.js process. Any service that parses attacker-supplied certificates, public keys, or PKCS structures using node-forge is at risk of complete availability loss (GitHub Advisory).

A proof-of-concept code snippet is publicly available in the GitHub Security Advisory, demonstrating construction of 2,000 nested BIT STRINGs and triggering the bug via asn1.fromDer(der, {maxDepth: 10}) — which parses all 2,000 levels despite the limit on version 1.4.0. No authentication or user interaction is required; the attack is network-accessible with low complexity. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is reported as 0.0, reflecting low current exploitation probability (GitHub Advisory, Feedly).

1. Identify target: Locate applications using node-forge versions ≤ 1.4.0 that accept attacker-supplied DER or PEM input — such as TLS endpoints, certificate upload APIs, or PKCS structure parsers.
2. Construct malicious payload: Build a DER structure of deeply nested primitive BIT STRINGs wrapping a NULL using the advisory PoC pattern:

var asn1 = forge.asn1;
var obj = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.NULL, false, '');
for(var i = 0; i < 2000; ++i) {
  obj = asn1.create(asn1.Class.UNIVERSAL, asn1.Type.BITSTRING, false, [obj]);
}
var der = asn1.toDer(obj).getBytes(); // ~9,886 bytes

3. Optionally wrap as PEM: Encode the DER payload as a PEM certificate or public key to reach higher-level APIs such as pki.certificateFromPem() or pki.publicKeyFromPem().
4. Deliver payload: Submit the crafted DER/PEM to the target application via any input vector that triggers asn1.fromDer() — e.g., a TLS handshake presenting a malicious server certificate, an HTTP endpoint accepting certificate uploads, or a PKCS#12 import function.
5. Trigger resource exhaustion: The parser recurses through all nested BIT STRING levels ignoring maxDepth, consuming excessive CPU and memory. A ~10 KB payload uses ~600 MB; a ~200 KB payload aborts the Node.js process with an uncatchable out-of-memory fatal error, achieving denial of service (GitHub Advisory).

• Network: Unusually large or malformed DER/PEM certificate or key submissions to application endpoints; repeated small (~10–200 KB) PEM or DER payloads sent to TLS handshake or certificate parsing APIs.
• Process: Node.js process exhibiting sudden spike in CPU utilization followed by crash; fatal error messages such as FATAL ERROR: JavaScript heap out of memory in process output or system logs; unexpected process restarts of Node.js-based services.
• Logs: Application logs showing repeated parsing errors or rejections of certificate/key inputs immediately before a service crash; Node.js crash dumps or core files generated around the time of the incident.
• File System: Presence of Node.js heap dump files (e.g., heapdump-*.heapsnapshot) if heap dump-on-OOM is configured, potentially containing the malicious DER payload in memory (GitHub Advisory).

The primary remediation is to upgrade node-forge to version 1.4.1, which applies maxDepth to BIT STRING content decoding and restricts decoding to only one level of BIT STRING contents (forge v1.4.1 Release). As a partial workaround for code that calls forge.asn1.fromDer() directly and does not require encapsulated BIT STRING content decoding, pass {decodeBitStrings: false} — note this changes the parsed structure. This workaround is not available for higher-level APIs (pki, PKCS, TLS) which rely on the decoded form; upgrading is the only remedy for those. Additionally, implementing network-level rate limiting on endpoints that process DER/PEM input can reduce exposure until patching is complete (GitHub Advisory).

The vulnerability was reported by Ethan Kim (cremit.io), Youngjoon Kim (Georgia Tech SSLab), @arpitjain099, and Mike Read, and was published with AI assistance by maintainer davidlehn on October 27, 2026 (GitHub Advisory). The advisory explicitly notes this is an incomplete fix of the prior CVE-2025-66031, highlighting a recurring challenge in fully addressing recursive parsing vulnerabilities in ASN.1 parsers. No significant broader media coverage or notable social media commentary beyond standard CVE tracking feeds has been identified at this time.