Title: Bump node-forge from 1.4.0 to 1.4.1 by dependabot[bot] · Pull Request #4288 · github/codeql-action · GitHub
Open Graph Title: Bump node-forge from 1.4.0 to 1.4.1 by dependabot[bot] · Pull Request #4288 · github/codeql-action
X Title: Bump node-forge from 1.4.0 to 1.4.1 by dependabot[bot] · Pull Request #4288 · github/codeql-action
Description: Bumps node-forge from 1.4.0 to 1.4.1.
Changelog
Sourced from node-forge's changelog.
1.4.1 - 2026-10-27
Notes
This release involved coordinating many security reports from many groups,
people, and robots over too long period of time. Thank you for your reports
and patience.
Claude Code was used to help organize, track, untangle, merge, test,
validate, fix, and improve it all. Further verification of fixes would be
welcome.
Tracking credits was challenging for some issues due to multiple email and
GitHub reports, incomplete contact details, or combining of partial reports
and fixes. Please let us know if there are credits changes needed here or in
advisory data.
Security
HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field in
DigestAlgorithm.
RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low
public exponent keys (e=3). The fix for CVE-2026-33894 only checked the
element count of the outer DigestInfo. Attackers can add "garbage" elements
inside the nested DigestAlgorithm SEQUENCE in order to construct a
signature that passes verification, enabling Bleichenbacher style forgery.
Reported by Geo (@geo-chen).
CVE ID: CVE-2026-85393
GHSA ID: GHSA-2g46-22mc-6gwp
HIGH: Signature forgery in RSA-PKCS due to non-canonical DigestInfo
encoding.
RSASSA PKCS#1 v1.5 signature verification accepts non-canonical DigestInfo
encodings, such as NULL parameters with content, non-minimal length
encodings, and non-canonical OIDs. These provide attackers space to
construct forged signatures for low public exponent keys (e=3), similar to
CVE-2026-33894 and CVE-2026-85393.
Reported by Oren Yomtov (@orenyomtov, Fireblocks), Bronson Yen (Calif.io,
in collaboration with Claude and Anthropic Research), Kamil Hałajda,
@pzartech, @antonlissone, and @Brechard.
CVE ID: CVE-2026-119192
GHSA ID: GHSA-6qrw-m8cv-hcxf
HIGH: ASN.1 resource exhaustion via BIT STRING decoding.
An Uncontrolled Recursion (CWE-674) and Uncontrolled Resource Consumption
(CWE-400) vulnerability in node-forge versions 1.4.0 and below enables
remote, unauthenticated attackers to exhaust CPU and memory with small
crafted DER or PEM inputs (certificates, keys, and other structures parsed
with asn1.fromDer()). By default fromDer() attempts to decode BIT
STRING contents as ASN.1. That decode ignored the global asn1.maxDepth
and the per-call maxDepth option, and BIT STRINGs nested in decoded BIT
STRINGs were decoded too, with each level keeping a full copy of its
decoded contents. Memory use grew quadratically with the nesting depth
and can terminate the process from heap exhaustion. The maxDepth bypass
is an incomplete fix of CVE-2025-66031.
Reported by:
... (truncated)
Commits
8a91737 Release 1.4.1.
fdd1b9f Update changelog.
4c1c3e3 Add changelog release notes.
0b455eb Ignore TLS heartbeat requests before the handshake.
e96c47b Fix jsbn modInverse hang with negative inputs.
f655560 Fix x509 CA store modification in chain verification.
797c3f8 Prevent prototype pollution from cookies in forge.http.
81774ff Require valid PKCS#7 padding in CBC and ECB decryption.
236845d Add AES-GCM tag length checks.
c7f4261 Verify certificate signatures with the child's scheme.
Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show
Open Graph Description: Bumps node-forge from 1.4.0 to 1.4.1. Changelog Sourced from node-forge's changelog. 1.4.1 - 2026-10-27 Notes This release involved coordinating many security reports from many groups, peopl...
X Description: Bumps node-forge from 1.4.0 to 1.4.1. Changelog Sourced from node-forge's changelog. 1.4.1 - 2026-10-27 Notes This release involved coordinating many security reports from many groups, p...
Opengraph URL: https://github.com/github/codeql-action/pull/4288
X: @github
Domain: github.com
| react-profiling | 0 |
| react-import-map | react,react-dom,react-dom/client,react-dom/profiling,react-is,react-reconciler,react/compiler-runtime,react/jsx-dev-runtime,react/jsx-runtime,scheduler@d5750093facf |
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:30169aab-a049-23bd-e534-52cde8e40d8b |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | D9C0:1587FA:8E729D:BD972D:6AED2D51 |
| html-safe-nonce | 8fc27a6eebd0217632c4dc2bbe0fb949bbccf0c5103258cc09d4f12d6c090ff0 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEOUMwOjE1ODdGQTo4RTcyOUQ6QkQ5NzJEOjZBRUQyRDUxIiwidmlzaXRvcl9pZCI6IjgxNjQ4NTExNDQ5NTQwMzE0NDEiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | 4a66a49c0a7642e8ee41907e06a76eff189515399b9616204a409fde0945b829 |
| hovercard-subject-tag | pull_request:5135625605 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/github/codeql-action/pull/4288/files |
| twitter:image | https://avatars.githubusercontent.com/in/29110?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/in/29110?s=400&v=4 |
| og:image:alt | Bumps node-forge from 1.4.0 to 1.4.1. Changelog Sourced from node-forge's changelog. 1.4.1 - 2026-10-27 Notes This release involved coordinating many security reports from many groups, peopl... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | e51d0b7b5ab34b1688c05b54c3ed17b8658b2fa9bca973a9c740683ccb12cf4a |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/github/codeql-action git https://github.com/github/codeql-action.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 259445878 |
| octolytics-dimension-repository_nwo | github/codeql-action |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 259445878 |
| octolytics-dimension-repository_network_root_nwo | github/codeql-action |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 59ebb7b901cc154ecc179a44f266fcf69f343b30 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width