Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior
    to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the
    relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(),
    including when searching for a matching END line and parsing encapsulated headers. An unauthenticated
    attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long
    malformed message and cause denial of service. This issue is fixed in version 1.4.1. (CVE-2026-118779)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior     to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the     relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(),     including when searching for a matching END line and parsing encapsulated headers. An unauthenticated     attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long     malformed message and cause denial of service. This issue is fixed in version 1.4.1. (CVE-2026-118779)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478123	Chainguard: kubeflow-centraldashboard: security update to 2.0.0-r8	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
478123	Chainguard: kubeflow-centraldashboard: security update to 2.0.0-r8	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
478064	SCA: security update for node-forge (GHSA-7wch-p9px-956x)	Tenable Cloud Security	SCA Checks	Local	high
478064	SCA: security update for node-forge (GHSA-7wch-p9px-956x)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
374486	Linux Distros Unpatched Vulnerability : CVE-2026-118779	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-118779

high

Tenable Plugins

high

high

high

high

high