node-forge CVE-2026-119191

The target application must call node-forge's asn1.fromDer() with default options (decodeBitStrings defaults to true) on attacker-supplied input - this is the case for the higher-level pki.certificateFromPem(), pki.publicKeyFromPem(), and the PKCS#7/#8/#12 loaders, and for forge's TLS client when it parses a server certificate. No authentication or user interaction is required (PR:N/UI:N), and default configurations are vulnerable; versions 1.3.2 through 1.4.0 are affected (this is an incomplete fix of CVE-2025-66031, so 1.3.2-1.4.0 remain exposed even after that earlier patch). Limiting factor for direct callers: code that calls forge.asn1.fromDer() directly and does not need encapsulated BIT STRING contents can pass {decodeBitStrings: false} as a workaround, but the PKI/PKCS/TLS APIs do not expose this option and rely on the decoded form, so for those the only remedy is upgrading to 1.4.1.

This is a genuine but bounded priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) is internally consistent with the evidence: a remote, unauthenticated attacker (PR:N, UI:N) can trigger the flaw with low complexity (AC:L) by supplying a small crafted DER/PEM blob, and impact is availability-only (C:N/I:N/A:H) - denial of service via CPU and quadratic memory exhaustion that can abort the Node.js process with an uncatchable out-of-memory error. The affected API surface is broad and reached by default options (pki.certificateFromPem(), pki.publicKeyFromPem(), PKCS#7/#8/#12 loaders, and forge's TLS client parsing server certificates), which raises real exposure for any service that parses attacker-influenced certificates/keys. Counterbalancing signals: this is NOT in CISA KEV (no confirmed active exploitation), EPSS is not provided in the input (exploitation probability cannot be quantified), and the vuln.today decision label is 'this_week' rather than act_now/emergency. A public PoC reference exists in the GHSA advisory; it is not verified as working exploit code in the input. The GHSA notes this is an incomplete fix of CVE-2025-66031, so environments that only applied the earlier patch (1.3.2-1.4.0) remain exposed. Net: a legitimate high-severity DoS worth prompt patching, not a confidentiality/integrity breach and not evidenced as widely exploited.

An attacker submits a small (~10-200 KB) PEM/DER structure containing nested BIT STRINGs - for example a crafted certificate or public key - to any endpoint whose server-side code parses it with node-forge's default asn1.fromDer() (e.g. pki.certificateFromPem()). Parsing recurses past the maxDepth limit and retains deep copies at each level, consuming hundreds of MB to over 1 GB and aborting the process with an uncatchable heap-out-of-memory error. A public PoC reference exists in the GHSA advisory (nested BIT STRINGs around a NULL); it is not verified as working exploit code in the input.