Forge (node-forge): Regular expression denial of service in forge.http header trimming
Summary
The forge.http module of the JavaScript TLS and cryptography library Forge (node-forge) uses a regular expression with quadratic runtime to trim response header values and cookie names and values. A malicious server or an on-path attacker can send a response with a long whitespace run followed by a non-whitespace character, which blocks the Node.js event loop or browser tab for minutes. Only applications that use forge.http with a socket pool to communicate with an untrusted server are affected; the issue has no confidentiality or integrity impact.
Affected
- Forge (node-forge) from 0.1.2 before 1.4.3
- Only applications that use forge.http with a socket pool against untrusted servers
Fixed in
- Upgrade to version 1.4.3 or later
Workaround
- Unknown. The vendor does not describe a workaround; limiting response header size in the socket pool handlers is a third-party suggestion.
Exploitation
- No in-the-wild exploitation known.
- CISA SSVC: exploitation status PoC, not automatable, partial technical impact.
Our recommendation
- Identify all copies of node-forge with npm ls node-forge or a lockfile scan, including transitive dependencies.
- Check whether application code imports forge.http; if so, prioritise the upgrade.
- Upgrade to 1.4.3 and test certificate validation and TLS paths first, because this release also changes X.509 nameConstraints behaviour and fixes other issues.
- Priority is low to medium for most SMEs; plan it with regular dependency maintenance.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 326a4d0 (GitHub) github.com
- Release 1.4.3 pull request (GitHub) github.com
- Release v1.4.3 (GitHub) github.com
- GitHub Security Advisory GHSA-6cv4-p8m7-4r25 github.com
- OSV entry GHSA-6cv4-p8m7-4r25 osv.dev
- GitLab Advisory CVE-2026-125333 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:11.
Original description (NVD)
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take quadratic time. A malicious server or on-path attacker can supply a long whitespace run followed by a non-whitespace character in a response header, causing response.readHeader() or response.getCookies() to repeatedly scan the input and block the Node.js event loop or browser tab for minutes. Applications are affected only when they use forge.http with a socket pool to communicate with an untrusted server; forge.http is not loaded by require('node-forge'), and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
NVD references (5)
- https://github.com/digitalbazaar/forge/commit/326a4d0903ee46358bc849a5c3fd96d9c21489bd
- https://github.com/digitalbazaar/forge/pull/1169
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.3
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-6cv4-p8m7-4r25
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-6cv4-p8m7-4r25
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.