node-forge EUVD-2026-113363

Exploitation requires the application to call forge.cipher.createDecipher('AES-GCM') and pass a zero-like tagLength value - specifically 0, null, false, '', or '0' (any value that Number()-converts to 0) - most commonly when tagLength is derived from the length of a received authentication tag (e.g. receivedTag.length * 8 for an empty tag) or left as an unset/zero configuration value. The attacker must also supply an empty or missing tag. Limiting factors that sharply narrow real-world exposure: applications that omit tagLength entirely (using the 128-bit default) or pass any fixed valid NIST tag length (128, 120, 112, 104, 96, 64 or 32 bits) are NOT affected, and the flaw only exists in node-forge <= 1.4.0. The impact is restricted to integrity (message forgery/modification); there is no confidentiality or availability impact.

This is a genuine but conditional integrity flaw, not a blanket critical issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9 Moderate) is internally consistent with the mechanism: the attack is network-reachable and needs no attacker privileges or user interaction (PR:N/UI:N), but AC:H correctly reflects that success depends on a condition outside the attacker's control - the application must call forge.cipher.createDecipher('AES-GCM') with a zero-like tagLength (0, null, false, '', '0'), typically one derived from the length of a received tag. Impact is integrity-only (C:N/I:H/A:N): an empty computed tag makes decipher.finish() accept any ciphertext as authentic, enabling message forgery and, because GCM is a stream cipher, targeted plaintext modification. No EPSS score, KEV listing, or SSVC automatable/technical-impact values were provided in the input, so probabilistic exploitation signals are absent and cannot be weighed. The vuln.today decision label is 'this_month' (not act_now/emergency), and the vendor rates it Moderate; there is no CISA KEV entry, so this should be treated as a scheduled-remediation item rather than an emergency. One divergence worth noting: the vendor's informational CVSS 4.0 vector scores it 8.2 (High) because 4.0 weights the attack preconditions (AT:P) differently; the authoritative rating follows CVSS 3.1 at 5.9. The real-world risk is concentrated in the subset of deployments that derive tagLength from received data - applications that omit tagLength (128-bit default) or pass a fixed valid length are not affected at all.

An attacker who can deliver ciphertext to an application that starts an AES-GCM decipher with a tagLength derived from received data - e.g. tagLength: receivedTag.length * 8, which is 0 for an empty tag - submits attacker-chosen bytes with an empty or missing authentication tag; on node-forge <= 1.4.0 decipher.finish() returns true, so the forged data is accepted as authentic, and because GCM is a stream cipher an attacker who knows the plaintext can also flip it to chosen values. The GHSA advisory (GHSA-5cwg-6vw7-rj6p) includes a working proof-of-concept snippet demonstrating this; it is a public PoC reference and not independently verified here as standalone weaponized exploit code. Network vector with no authentication or user interaction, but AC:H because it only works when the application already passes a zero-like tagLength.