CVE-2026-118777

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.

• CWE-1321

• https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991
• https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11877An unauthorized user can modify configuration through API ca…7.5
• CVE-2026-118772joi is a schema description language and data validator for …7.5
• CVE-2026-118773Glob matches files using patterns the shell uses. From 9.0.0…6.3
• CVE-2026-118774Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118775Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118776Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118778Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-118779Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-11878Improper neutralization of input during web page generation …6.1
• CVE-2026-118780Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118781Forge (also called node-forge) is a native implementation of…2.9
• CVE-2026-118782Forge (also called node-forge) is a native implementation of…7.5