Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior
    to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate
    subject names to process the relevant input or security decision. node-forge modified the CA store while
    trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain
    verification could permanently remove trusted CA certificates from the store, causing later valid chains
    to fail and creating a persistent availability impact for applications that reused the store. This issue
    is fixed in version 1.4.1. (CVE-2026-118780)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior     to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate     subject names to process the relevant input or security decision. node-forge modified the CA store while     trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain     verification could permanently remove trusted CA certificates from the store, causing later valid chains     to fail and creating a persistent availability impact for applications that reused the store. This issue     is fixed in version 1.4.1. (CVE-2026-118780)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478133	Chainguard: kubeflow-centraldashboard: security update to 2.0.0-r8	Tenable Cloud Security	Chainguard Local Security Checks	Local	low
478133	Chainguard: kubeflow-centraldashboard: security update to 2.0.0-r8	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	low
478065	SCA: security update for node-forge (GHSA-4487-j8r4-4g2f)	Tenable Cloud Security	SCA Checks	Local	low
478065	SCA: security update for node-forge (GHSA-4487-j8r4-4g2f)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
374465	Linux Distros Unpatched Vulnerability : CVE-2026-118780	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-118780

low

Tenable Plugins

low

low

low

low

low