Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a Vulnerability

Please report security issues to security@digitalbazaar.com.

node-forge ASN.1 OID Integer Truncation
GHSA-65ch-62r8-g69g published Nov 25, 2025 by davidlehn

Moderate
node-forge ASN.1 Unbounded Recursion
GHSA-554w-wpv2-vw27 published Nov 25, 2025 by davidlehn

High
node-forge ASN.1 Validator Desynchronization
GHSA-5gfm-wpxj-wjgq published Nov 25, 2025 by davidlehn

High
RSA PKCS#1 v1.5 signature verification failing to check tailing garbage bytes can lead to signature forgery.
GHSA-x4jg-mjrx-434g published Mar 17, 2022 by davidlehn

High
RSA PKCS#1 v1.5 signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery.
GHSA-cfm4-qjh2-4765 published Mar 17, 2022 by davidlehn

High
RSA PKCS#1 v1.5 signature verification leniency in checking `DigestInfo` structure.
GHSA-2r2c-g63r-vccr published Mar 17, 2022 by davidlehn

Moderate
URL parsing in node-forge could lead to undesired behavior.
GHSA-gf8q-jrpm-jvxq published Jan 6, 2022 by davidlehn

Low
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in node-forge debug API.
GHSA-5rrq-pxf6-6jx5 published Jan 6, 2022 by davidlehn

Low
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in node-forge util.setPath API
GHSA-wxgw-qj99-44c2 published Jan 6, 2022 by davidlehn

Low

Learn more about advisories related to digitalbazaar/forge in the GitHub Advisory Database