Hoch 7.5Linux-Server
CVE-2026-119191
node-forge: node-forge: Denial of Service via nested ASN.1 BIT STRING decoding
node-forge
### Summary `asn1.fromDer()` decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the `maxDepth` recursion limit (an incomplete fix of CVE-2025-66031) and also decoded nested BIT STRINGs, keeping a full copy of the decoded contents at each level, so small crafted DER or PEM inputs (certificates, keys, PKCS structures) use excessive CPU time and memory and can abort the Node.js process. Fixed in node-forge 1.4.1. ### Details `asn1.fromDer()` attempts…
29. Okt 2026
Original bei Red Hat öffnen