Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior
    to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero
    or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt,
    allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based
    integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using
    pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted
    SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by
    forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in
    version 1.4.1. (CVE-2026-118782)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior     to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero     or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt,     allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based     integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using     pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted     SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by     forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in     version 1.4.1. (CVE-2026-118782)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478136	Chainguard: kubeflow-centraldashboard: security update to 2.0.0-r8	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
478136	Chainguard: kubeflow-centraldashboard: security update to 2.0.0-r8	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
478058	SCA: security update for node-forge (GHSA-jc66-7q78-782g)	Tenable Cloud Security	SCA Checks	Local	high
478058	SCA: security update for node-forge (GHSA-jc66-7q78-782g)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
374477	Linux Distros Unpatched Vulnerability : CVE-2026-118782	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-118782

high

Tenable Plugins

high

high

high

high

high