Niedrig 3.7Linux-Server
CVE-2026-118776
node-forge: node-forge: Data integrity failure via improper PKCS#7 padding validation
node-forge
### Summary `decipher.finish()` in CBC and ECB mode accepted malformed PKCS#7 padding: only the last byte was checked, against a limit of four blocks, so mismatched padding bytes, a zero count and oversized counts were accepted and up to four blocks of plaintext could be silently removed. Fixed in node-forge 1.4.1. ### Details `modes.cbc.prototype.unpad()` and `modes.ecb.prototype.unpad()` in `lib/cipherModes.js` read the last decrypted byte as the PKCS#7 padding count…
29. Okt 2026
Original bei Red Hat öffnen