Riskcovery

CVE-2026-118780

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

State
Published
Severity
3.7 Low
Published
Oct 29, 2026
Updated
Oct 29, 2026
Reserved
Oct 28, 2026

Read the record on cve.org

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.

Scores

CVSSScoreVectorSource
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LGitHub_M

Weaknesses

  • CWE-295 Improper Certificate Validation
  • CWE-471 Modification of Assumed-Immutable Data (MAID)

Affected Products

ProductVersions
forgedigitalbazaar
  • < 1.4.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.