Detections
Analytics
SCA: security update for node-forge (GHSA-4642-5mcj-2rqw)
low Tenable Cloud Security Plugin ID 478089
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior
to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application
that accepted an untrusted OID string, checked or authorized that string, and then encoded it with
asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER
parsing is not affected. This issue is fixed in version 1.4.1. (CVE-2026-118775)
Solution
Update the node-forge library and its related packages to version 1.4.1 or later.See Also
Plugin Details
Severity: Low
ID: 478089
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/31/2026
Updated: 10/31/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2026-118775
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/30/2026
Vulnerability Publication Date: 10/29/2026
Reference Information
CVE: CVE-2026-118775
cwe: CWE-190