[dependabot]

Bumps node-forge from 1.3.3 to 1.4.2.

Changelog

Sourced from node-forge's changelog.

1.4.2 - 2026-10-27

Fixed

• [pem] Convert non-string input to a string in pem.decode() as before 1.4.1. The 1.4.1 PEM ReDoS fix (GHSA-7wch-p9px-956x) caused a TypeError for Buffer input, which is used by node-jose. (#1165)

1.4.1 - 2026-10-27

Notes

• This release involved coordinating many security reports from many groups, people, and robots over too long period of time. Thank you for your reports and patience.
• Claude Code was used to help organize, track, untangle, merge, test, validate, fix, and improve it all. Further verification of fixes would be welcome.
• Tracking credits was challenging for some issues due to multiple email and GitHub reports, incomplete contact details, or combining of partial reports and fixes. Please let us know if there are credits changes needed here or in advisory data.

Security

• HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field in DigestAlgorithm.
  • RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). The fix for CVE-2026-33894 only checked the element count of the outer DigestInfo. Attackers can add "garbage" elements inside the nested DigestAlgorithm SEQUENCE in order to construct a signature that passes verification, enabling Bleichenbacher style forgery.
  • Reported by Geo (@​geo-chen).
  • CVE ID: CVE-2026-85393
  • GHSA ID: GHSA-2g46-22mc-6gwp
• HIGH: Signature forgery in RSA-PKCS due to non-canonical DigestInfo encoding.
  • RSASSA PKCS#1 v1.5 signature verification accepts non-canonical DigestInfo encodings, such as NULL parameters with content, non-minimal length encodings, and non-canonical OIDs. These provide attackers space to construct forged signatures for low public exponent keys (e=3), similar to CVE-2026-33894 and CVE-2026-85393.
  • Reported by Oren Yomtov (@​orenyomtov, Fireblocks), Bronson Yen (Calif.io, in collaboration with Claude and Anthropic Research), Kamil Hałajda, @​pzartech, @​antonlissone, and @​Brechard.
  • CVE ID: CVE-2026-119192
  • GHSA ID: GHSA-6qrw-m8cv-hcxf
• HIGH: ASN.1 resource exhaustion via BIT STRING decoding.
  • An Uncontrolled Recursion (CWE-674) and Uncontrolled Resource Consumption (CWE-400) vulnerability in node-forge versions 1.4.0 and below enables remote, unauthenticated attackers to exhaust CPU and memory with small crafted DER or PEM inputs (certificates, keys, and other structures parsed

... (truncated)

Commits

• 7928054 Release 1.4.2.
• 1d8c245 Update changelog.
• ce5b576 Convert non-string input in pem.decode().
• c1d64ef Fix changelog typo.
• 453d196 Start 1.4.2-0.
• 8a91737 Release 1.4.1.
• fdd1b9f Update changelog.
• 4c1c3e3 Add changelog release notes.
• 0b455eb Ignore TLS heartbeat requests before the handshake.
• e96c47b Fix jsbn modInverse hang with negative inputs.
• Additional commits viewable in compare view

[dependabot]

Superseded by #35.