forge

Every one of the 30 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Improper Verification of Cryptographic Signature in `node-forge`CVE-2022-24772digitalbazaar · CVSS 7.5 · 1.1% likely

   CWE-347

2. Improper Verification of Cryptographic Signature in `node-forge`CVE-2022-24773digitalbazaar · CVSS 5.3 · 1.0% likely

   CWE-347

3. Improper Verification of Cryptographic Signature in node-forgeCVE-2022-24771digitalbazaar · CVSS 7.5 · 0.8% likely

   CWE-347

4. Forge: Regular expression denial of service in PEM decoding (pem.decode)CVE-2026-118779digitalbazaar · CVSS 7.5 · 0.7% likely

   CWE-1333

5. Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputCVE-2026-33891digitalbazaar · CVSS 7.5 · 0.6% likely

   CWE-835

6. Forge: ReDoS in forge.http response header and cookie trimmingCVE-2026-125333digitalbazaar · CVSS 5.9 · 0.6% likely

   CWE-1333

7. Forge has signature forgery in Ed25519 due to missing S > L checkCVE-2026-33895digitalbazaar · CVSS 7.5 · 0.5% likely

   CWE-347

8. Forge has signature forgery in RSA-PKCS due to ASN.1 extra fieldCVE-2026-33894digitalbazaar · CVSS 7.5 · 0.5% likely

   CWE-347

9. node-forge ASN.1 Unbounded RecursionCVE-2025-66031digitalbazaar · CVSS 8.7 · 0.4% likely

   CWE-674

10. Forge: TLS client crash on an unsupported ServerHello compression methodCVE-2026-125332digitalbazaar · CVSS 5.9 · 0.4% likely

    CWE-248

11. Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDerCVE-2026-119191digitalbazaar · CVSS 7.5 · 0.4% likely

    CWE-400

12. Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageCVE-2026-119188digitalbazaar · CVSS 7.5 · 0.4% likely

    CWE-248

13. Forge: Denial of service in TLS record processing via call stack exhaustionCVE-2026-119187digitalbazaar · CVSS 7.5 · 0.4% likely

    CWE-674

14. Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)CVE-2026-33896digitalbazaar · CVSS 7.4 · 0.4% likely

    CWE-295

15. node-forge ASN.1 OID Integer TruncationCVE-2025-66030digitalbazaar · CVSS 6.3 · 0.3% likely

    CWE-190

16. Forge: ASN.1 OID first arc truncation in asn1.oidToDerCVE-2026-118775digitalbazaar · CVSS 3.7 · 0.3% likely

    CWE-190

17. Forge: TLS client crash on a handshake record received without a sessionCVE-2026-125334digitalbazaar · CVSS 5.9 · 0.3% likely

    CWE-476

18. Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieCVE-2026-118777digitalbazaar · CVSS 4.8 · 0.3% likely

    CWE-1321

19. node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm PaddingCVE-2026-85393digitalbazaar · CVSS 7.5 · 0.2% likely

    CWE-347

20. Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)CVE-2026-118781digitalbazaar · CVSS 2.9 · 0.2% likely

    CWE-835

21. Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13CVE-2026-119190digitalbazaar · CVSS 7.4 · 0.2% likely

    CWE-295

22. Forge: X.509 nameConstraints not enforced by verifyCertificateChain()CVE-2026-125336digitalbazaar · CVSS 7.4 · 0.2% likely

    CWE-295

23. Forge: TLS client crash when the server sends no certificateCVE-2026-118778digitalbazaar · CVSS 5.9 · 0.2% likely

    CWE-476

24. Forge: Ed25519 signature verification accepts small-order public keysCVE-2026-125335digitalbazaar · CVSS 3.7 · 0.2% likely

    CWE-347

25. Forge: AES-GCM authentication bypass via unvalidated tagLength optionCVE-2026-119186digitalbazaar · CVSS 5.9 · 0.2% likely

    CWE-354

26. Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeCVE-2026-118780digitalbazaar · CVSS 3.7 · 0.2% likely

    CWE-295

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.