CVE-2026-125333

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take quadratic time. A malicious server or on-path attacker can supply a long whitespace run followed by a non-whitespace character in a response header, causing response.readHeader() or response.getCookies() to repeatedly scan the input and block the Node.js event loop or browser tab for minutes. Applications are affected only when they use forge.http with a socket pool to communicate with an untrusted server; forge.http is not loaded by require('node-forge'), and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.

• CWE-1333

• https://github.com/digitalbazaar/forge/commit/326a4d0903ee46358bc849a5c3fd96d9c21489bd
• https://github.com/digitalbazaar/forge/pull/1169
• https://github.com/digitalbazaar/forge/releases/tag/v1.4.3
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-6cv4-p8m7-4r25
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-6cv4-p8m7-4r25

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125327pgEdge RAG Server is an API server for retrieval-augmented g…7.5
• CVE-2026-125328pgEdge Go LLM Library provides a unified Go interface for mu…5.8
• CVE-2026-125329Kaneo is a project management application with boards, Gantt…8.4
• CVE-2026-125330HarnessRouter is a self-hosted unified API for agent harness…7.5
• CVE-2026-125331HarnessRouter is a self-hosted unified API for running agent…9.1
• CVE-2026-125332Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-125334Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-125335Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-125336Forge (also called node-forge) is a native implementation of…7.4
• CVE-2026-125337Winter CMS is a content management system built on the Larav…8.3
• CVE-2026-125338Winter CMS is a content management system built on the Larav…4.5
• CVE-2026-125339Winter CMS is a content management system built on the Larav…6.1