node-forge CVE-2026-118782

Exploitation requires that the application import PKCS#12/PFX files or PKCS#8 ENCRYPTED PRIVATE KEY input from an untrusted source via forge.pkcs12.pkcs12FromAsn1() or forge.pki.decryptPrivateKeyInfo(), and rely on password-based MAC verification or successful PBE decryption to establish that the file was produced by someone who knows the password; this is the default API and call pattern, so no non-default configuration is needed. The flaw is reached specifically through the PKCS#12 MAC path and the PKCS#12 PBE schemes pbeWithSHAAnd3-KeyTripleDES-CBC and pbewithSHAAnd40BitRC2-CBC (including shrouded key bags and encrypted SafeContents). Limiting factors: content protected with PBES2/PBKDF2 is NOT affected; the attacker gains no knowledge of the password or the original private key; and the attack only matters where PKCS#12 input comes from an untrusted party - applications that only load their own trusted keystores are not meaningfully exposed. No password, decryption oracle, or user interaction is required, only one offline HMAC computation.

This is a genuine integrity-bypass issue with a confirmed, working PoC, but its real-world urgency is scoped by how the library is used. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5 High) reflects a network-reachable, low-complexity, no-privilege, no-interaction attack whose only impact is integrity (C:N/A:N) - the attacker forges a valid MAC / decrypts PBE content so a tampered PKCS#12 verifies under any password, but does not learn the password or original key. No EPSS score and no CISA KEV entry were provided in the input, so there is no signal of mass or active exploitation; the vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with a serious but not actively-exploited flaw. The AV:N rating should be read carefully: the mechanism is actually malicious PKCS#12/PFX or PKCS#8 data being imported, so 'network' applies only where the application ingests such files from untrusted remote sources - the practical risk concentrates on apps that import PKCS#12/PFX or encrypted private keys from untrusted parties and trust MAC/decryption success as proof of authenticity. Signals are consistent rather than conflicting (vendor CVSS 3.1 and 4.0 both rate High; PoC is real; no KEV/EPSS to contradict), so this is a legitimate patch priority for affected consumers rather than a high-CVSS-but-hollow finding, but it is not a drop-everything emergency absent exploitation data.

An application uses node-forge to import PKCS#12/PFX files or PKCS#8 encrypted private keys supplied by untrusted parties and treats a successful password-based MAC check (or successful decryption) as proof the file came from someone who knows the password. An attacker who does not know the password replaces the file's contents with their own certificate and private key, sets MacData.iterations to 0, and computes a valid HMAC-SHA1 using the fixed constant key (0x03 repeated 20 times), so forge.pkcs12.pkcs12FromAsn1() reports the file as verified under whatever password the application supplies. Working exploit code exists: a PoC is published in the GHSA advisory and committed to the repository under tests/pocs/, requiring only a single offline HMAC and no oracle, password, or user interaction.