CVE-2026-118776

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1.

• CWE-20
• CWE-354

• https://github.com/digitalbazaar/forge/commit/81774ff99e2da64aec9a43591df45a360040c136
• https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-2vgq-wchc-25w7

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118769Botan is a C++ cryptography library. From 2.1.0 until 3.13.0…9.2
• CVE-2026-11877An unauthorized user can modify configuration through API ca…7.5
• CVE-2026-118772joi is a schema description language and data validator for …7.5
• CVE-2026-118773Glob matches files using patterns the shell uses. From 9.0.0…6.3
• CVE-2026-118774Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118775Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118777Forge (also called node-forge) is a native implementation of…4.8
• CVE-2026-118778Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-118779Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-11878Improper neutralization of input during web page generation …6.1
• CVE-2026-118780Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118781Forge (also called node-forge) is a native implementation of…2.9