CVE-2026-119191

{
  "etk_id": "ETK-2026-3002",
  "cve_id": "CVE-2026-119191",
  "display_id": "CVE-2026-119191",
  "ghsa_id": "GHSA-rhr8-3pm8-cq29",
  "euvd_id": "EUVD-2026-113348",
  "status": "published",
  "anchor_state": "anchored",
  "title": "ASN.1 resource exhaustion in digitalbazaar forge",
  "summary": "Forge versions before 1.4.1 can consume excessive CPU and memory while parsing crafted DER ASN.1 input containing deeply nested BIT STRING values. An attacker must be able to cause the application to process untrusted DER data with asn1.fromDer().",
  "mitigation": "Upgrade forge to version 1.4.1 or later. Until upgrades are complete, prevent untrusted DER input from reaching ASN.1 parsing paths where possible.",
  "vendor": "digitalbazaar",
  "product": "forge",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.4.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.4.1"
      ],
      "package_name": "node-forge",
      "purl": "pkg:npm/node-forge"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.8425365,
  "t0_at": "2026-10-29T19:26:29.815000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T04:55:20+00:00",
      "days": -2.6049747106481482,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T19:26:29.815000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119191"
    }
  }
}