Bug 2563637 (CVE-2026-118775)

Summary: CVE-2026-118775 node-forge: node-forge: Authorization bypass via improper OID encoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abarbaro, alizardo, amctagga, aoconnor, bbrownin, bniver, cdrage, csuconic, dbruscin, dhanak, doconnor, drosa, dschmidt, dsimansk, flucifre, fmariani, gmalinko, gmeno, groman, gtully, janstey, jchui, jhe, jlanda, jsherman, jwon, kaycoth, kingland, kshier, ktsao, kvanderr, lchilton, mbenjamin, mcarlett, mhackett, mnovotny, nboldt, oaljalju, pdelbell, pjindal, psrna, rbobbitt, rgemmell, rgodfrey, rhel-process-autobot, rstepani, rushinde, sausingh, sfeifer, simaishi, sostapov, stcannon, tbish, tcunning, tlavocat, vereddy, watson-tool-maintainers, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in node-forge. A remote attacker can potentially bypass authorization controls by supplying specially crafted Object Identifier (OID) strings to an application. Due to missing range checks during data encoding, out-of-range values can wrap into valid Distinguished Encoding Rules (DER) byte sequences representing different, trusted identifiers. As a result, an attacker could cause an application to generate certificates or cryptographic structures with unauthorized attributes.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 19:12:18 UTC 
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1.