node-forge CVE-2026-118780

Requires an application that creates a CA store with pki.createCaStore() containing two or more trusted certificates sharing the SAME subject name (e.g. re-keyed/renewed CAs that kept their name, or a CA alongside a cross-signed version of itself - chiefly private PKIs), AND that reuses that same long-lived store object across multiple pki.verifyCertificateChain() calls (including forge.tls clients passing the same caStore to several connections). A remote, unauthenticated peer then sends any certificate whose issuer field equals the shared subject name; its signature/key can be arbitrary. LIMITING FACTORS: stores WITHOUT duplicate subject names are not affected at all; a fresh store per call (or passing an array of certificates so forge builds a new store per connection) avoids the issue; no invalid chain is ever accepted (integrity is not compromised); impact is confined to availability of verification against those specific CA certificates and persists only until the store is recreated.

All severity signals point to a low real-world priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L = 3.7, Low) shows a network-reachable, unauthenticated flaw with no confidentiality or integrity impact and only a limited availability impact, and high attack complexity reflecting the non-default precondition (a reused CA store holding duplicate-subject certificates). The vuln.today decision label is 'monitor,' consistent with a Low rating. No CISA KEV listing is present and no EPSS score was supplied, so exploitation-probability data is MISSING and cannot be weighed. The GHSA advisory publishes an illustrative proof-of-concept, but the input does not flag it as confirmed working exploit code. One genuine tension exists: the advisory's informational CVSS 4.0 vector (AV:N/AC:L/AT:P/.../VA:L = 6.3, Moderate) rates this higher because 4.0 weights the attack precondition (AT:P) differently than 3.1 weights AC:H - the vendor explicitly keeps the 3.1 Low rating, and this analysis follows that. Net: a real but narrow, condition-dependent denial-of-service of certificate verification, not an emergency; patch on a normal maintenance cycle.

An application reuses a long-lived node-forge CA store (via pki.createCaStore()) that holds two or more trusted CA certificates sharing the same subject name - typical of re-keyed/renewed or cross-signed CAs in private PKIs. A malicious TLS server, or a party submitting a signed document, presents a certificate naming that shared subject as its issuer; verification correctly fails but permanently shifts those CA certificates out of the store, so every later valid chain from those CAs is rejected until the store is recreated. A conceptual PoC demonstrating this is published in the GHSA advisory, though it is not verified as standalone working exploit code.