Mittel 5.9Linux-Server
CVE-2026-125333
node-forge: node-forge: Denial of Service via inefficient regular expression in HTTP header parsing
node-forge
`forge.http` trims response header and `Set-Cookie` values with the regular expression `/\s*$/`, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a `forge.http` client for minutes with one large response header. Fixed in node-forge 1.4.3. ### Details `_trimString()` in `lib/http.js` removes trailing whitespace with `str.replace(/\s*$/, '')`. On a string of n whitespace characters followed by a…
10. Nov 2026
Original bei Red Hat öffnen