StackPrism

npm package

node-forge vulnerabilities by version

The latest release, 1.4.0 (Mar 24, 2026), has 1 known vulnerability. 100% of last week’s 40M downloads went to versions with known vulnerabilities. OSV.dev lists 15 advisories for node-forge; the newest was published on Sep 3, 2026.

npm (opens in a new tab) describes it as “JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.”

Latest release
1.4.0
Mar 24, 2026, 1 known vulnerabilities
Downloads last week
40M
All versions, from npm
Advisories on OSV.dev
15
Newest Sep 3, 2026
Licence
(BSD-3-Clause OR GPL-2.0)
OpenSSF Scorecard
5/10
digitalbazaar/forge (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
1.4.0latestMar 24, 20261 known vulnerability, worst rated critical25.1M
1.3.1Mar 30, 20227 known vulnerabilities, worst rated critical7.3M
1.3.3Dec 2, 20254 known vulnerabilities, worst rated critical3M
0.10.0Sep 2, 202013 known vulnerabilities, worst rated critical2.1M
0.8.5Jun 19, 201915 known vulnerabilities, worst rated critical502.1K
1.3.2Nov 25, 20254 known vulnerabilities, worst rated critical484.1K
0.9.1Sep 26, 201915 known vulnerabilities, worst rated critical479.9K
0.9.0Sep 5, 201915 known vulnerabilities, worst rated critical267.6K

Who is still on a vulnerable node-forge

100% of last week’s 40M node-forge downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. node-forge doesn’t publish support dates we can check.

LineNewest releaseReleased
11.4.0Mar 24, 2026
0.100.10.0Sep 2, 2020
0.90.9.2Sep 2, 2020
0.80.8.5Jun 19, 2019
0.70.7.6Aug 14, 2018
0.60.6.49Feb 7, 2017

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. CriticalCVE-2026-33894 on OSV.dev (opens in a new tab)CVE-2026-85393

    node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

    Affects <= 1.4.0. Published Sep 3, 2026.

  2. CriticalCVE-2026-33896 on OSV.dev (opens in a new tab)GHSA-2328-f5f3-gj25

    Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

    Affects < 1.4.0. Published Mar 26, 2026.

  3. CriticalCVE-2026-33895 on OSV.dev (opens in a new tab)GHSA-q67f-28xg-22rw

    Forge has signature forgery in Ed25519 due to missing S > L check

    Affects < 1.4.0. Published Mar 26, 2026.

  4. CriticalCVE-2026-33891 on OSV.dev (opens in a new tab)GHSA-5m6q-g25r-mvwx

    Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

    Affects < 1.4.0. Published Mar 26, 2026.

  5. CriticalCVE-2025-66031 on OSV.dev (opens in a new tab)GHSA-554w-wpv2-vw27

    node-forge has ASN.1 Unbounded Recursion

    Affects < 1.3.2. Published Nov 26, 2025.

All 15 advisories are on OSV.dev (opens in a new tab).

Which node-forge do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for node-forge, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.