Repository navigation
fix(deps): update dependency node-forge to v1.4.2 - #19435
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
dependencies
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The upgraded OID validation rejects identifiers in the legacy-license fixture, causing the existing test to fail before verification and requiring fixture updates that preserve coverage of previously issued certificates.
1 open issue
What changed in this PR
Updates the OpenCTI backend’s node-forge dependency from 1.4.0 to 1.4.2, bringing upstream security fixes and restoring PEM decoding support for Buffer inputs.
Changes:
- Bumps the backend’s pinned dependency to 1.4.2.
- Synchronizes the Yarn lockfile resolution and checksum.
| File | Description |
|---|---|
yarn.lock |
Updates the resolved package, checksum, and backend dependency entry. |
opencti-platform/opencti-graphql/package.json |
Pins node-forge to 1.4.2. |
Review effort: Balanced
| "node-calls-python": "1.13.0", | ||
| "node-fetch": "3.3.2", | ||
| "node-forge": "1.4.0", | ||
| "node-forge": "1.4.2", |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #19435 +/- ##
==========================================
- Coverage 45.90% 40.41% -5.49%
==========================================
Files 3754 3754
Lines 156335 156335
Branches 42905 42905
==========================================
- Hits 71759 63188 -8571
- Misses 84576 93147 +8571
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.4.0→1.4.2Release Notes
digitalbazaar/forge (node-forge)
v1.4.2Compare Source
Fixed
pem.decode()as before1.4.1. The 1.4.1 PEM ReDoS fix (GHSA-7wch-p9px-956x) caused a
TypeErrorfor
Bufferinput, which is used bynode-jose.(#1165)
v1.4.1Compare Source
Notes
people, and robots over too long period of time. Thank you for your reports
and patience.
validate, fix, and improve it all. Further verification of fixes would be
welcome.
GitHub reports, incomplete contact details, or combining of partial reports
and fixes. Please let us know if there are credits changes needed here or in
advisory data.
Security
DigestAlgorithm.
public exponent keys (e=3). The fix for CVE-2026-33894 only checked the
element count of the outer DigestInfo. Attackers can add "garbage" elements
inside the nested DigestAlgorithm SEQUENCE in order to construct a
signature that passes verification, enabling Bleichenbacher style forgery.
encoding.
encodings, such as NULL parameters with content, non-minimal length
encodings, and non-canonical OIDs. These provide attackers space to
construct forged signatures for low public exponent keys (e=3), similar to
CVE-2026-33894 and CVE-2026-85393.
in collaboration with Claude and Anthropic Research), Kamil Hałajda,
@pzartech, @antonlissone, and @Brechard.
(CWE-400) vulnerability in node-forge versions 1.4.0 and below enables
remote, unauthenticated attackers to exhaust CPU and memory with small
crafted DER or PEM inputs (certificates, keys, and other structures parsed
with
asn1.fromDer()). By defaultfromDer()attempts to decode BITSTRING contents as ASN.1. That decode ignored the global
asn1.maxDepthand the per-call
maxDepthoption, and BIT STRINGs nested in decoded BITSTRINGs were decoded too, with each level keeping a full copy of its
decoded contents. Memory use grew quadratically with the nesting depth
and can terminate the process from heap exhaustion. The
maxDepthbypassis an incomplete fix of CVE-2025-66031.
SSLab.
node-forge versions 1.4.0 and below enables remote, unauthenticated
attackers to block the event loop with small crafted inputs to
pem.decode()and the APIs that parse PEM, such aspki.certificateFromPem()andpki.privateKeyFromPem(). The regularexpression that splits PEM messages takes polynomial time on input
without a matching END line; a 30 KB input took over 20 seconds. The
regular expressions that parse encapsulated headers took quadratic time
on long header lines.
exhaustion.
tls.createConnection()connections handle received records recursively:each record handler calls
process()again for the next buffered record.A peer can send one chunk of many small records, such as heartbeat
records, which are accepted in every state including before the
handshake, and
process()throwsRangeError: Maximum call stack size exceeded. In Node.js applications that callprocess()from a socketdatahandler, the exception is uncaught and terminates the process.Server and client connections are affected, and no authentication is
required.
record during a fragmented handshake message.
tls.createConnection()connection receives a record of anothertype (alert, change_cipher_spec, application data or heartbeat) while a
handshake message is split across records, it reports the error and
closes the connection, and then
process()throwsTypeError: Cannot set properties of null. A peer can trigger this with two small recordsbefore the handshake, without authentication, as a server or a client.
In Node.js applications that call
process()from a socketdatahandler, the exception is uncaught and terminates the process.
pkcs12.pkcs12FromAsn1()accepts a PKCS#12 MAC iteration count of zerofrom the input. With fewer than one iteration, the PKCS#12 key derivation
function (RFC 7292 Appendix B.2) does no hashing and returns a constant key
that does not depend on the password or salt. An attacker who does not know
the password can modify the contents of a PKCS#12/PFX file, such as
replacing certificates or keys, and compute a MAC that verifies with any
password. The PKCS#12 password-based encryption schemes
(
pbeWithSHAAnd3-KeyTripleDES-CBC,pbewithSHAAnd40BitRC2-CBC) areaffected the same way: with zero iterations they use a constant key and
IV, so a substituted encrypted private key decrypts with any password.
Research.
basicConstraintsbypass via deprecated extension OIDs incertificate chain verification.
2.5.29.10and2.5.29.13asbasicConstraints, andpki.verifyCertificateChain()used the first extension with that name. A certificate with a forged
deprecated-OID extension (
cATRUE) before its genuinebasicConstraintsextension (
cAFALSE) is accepted as a CA, and the same technique canhide a
pathLenConstraint. An attacker who obtains such a certificatefrom a trusted CA that copies extensions from certificate requests can
issue certificates for any name that node-forge accepts as valid.
certificate.
1.4.0 and below lets a malicious TLS server, or an on-path attacker who
removes the server's Certificate message, crash applications that use the
forge TLS client. The client's check for a missing server certificate
read the wrong property and never ran, so the handshake continued and
connection.process()threw aTypeErrorinstead of failing theconnection.
pathLenConstraintbypass in certificate chain verification.pki.verifyCertificateChain()only enforces thebasicConstraintspathLenConstraintof a CA certificate when that certificate also has akeyUsageextension. When a CA certificate with apathLenConstraintlacks
keyUsage, chains with more intermediate CA certificates below itthan the constraint allows are accepted. The holder of such a constrained
CA's key, or anyone it issues a CA certificate to, can create subordinate
CAs whose certificates node-forge accepts as valid.
@EchoSkorJjj.
tagLengthoption. With atagLengthof0(ornull,false,'', or'0'), the computed authentication tag isempty, and decryption with an empty or missing
tagsucceeds:decipher.finish()returnstruefor any ciphertext and additional data.An attacker can then forge or modify messages that the application accepts
as authentic. This requires the application to pass such a
tagLength,for example one derived from the length of a received tag. The default
tag length of 128 bits is not affected.
Set-Cookieinforge.http.1.4.0 and below lets a malicious server add properties to
Object.prototypeandObject, or deleteObject.prototypeproperties, in applications that use the
forge.httpclient (includedin the
forge.allbrowser bundle, not loaded byrequire('node-forge')).Cookie names and paths from
Set-Cookieheaders were used as keys of aplain object with
inchecks, so__proto__and inherited namesreached
Object.prototype.and below lets
asn1.oidToDer()encode an OID string with out of rangefirst arcs as a different OID, e.g.
0.42.840.113549.1.1.1or4294977127.18.840.113549.1.1.1as rsaEncryption(
1.2.840.113549.1.1.1), which can bypass OID-based decisions made onthe string. The fix for CVE-2025-66030 only checked the later arcs.
vulnerability in node-forge versions 1.4.0 and below lets a certificate
labeled as signed with RSASSA-PSS pass chain verification with a PKCS#1
v1.5 signature.
certificate.verify(child)andverifyCertificateChain()chose the RSA padding scheme and PSS parameters from the issuer
certificate instead of the child certificate. The signature must still
be made with the issuer's key, so this only misleads applications that
rely on a certificate's signature algorithm.
node-forge versions 1.4.0 and below makes
decipher.finish()acceptmalformed padding in CBC and ECB mode. Only the last byte was checked,
against a limit of four blocks, so mismatched padding bytes, a zero count
and counts larger than a block were accepted, and up to four blocks of
plaintext could be removed. CBC and ECB without a MAC never provide
integrity, and this fix doesn't change that; use AES-GCM or authenticate
the ciphertext.
(@hibrian827, Georgia Tech SSLab, Team Atlanta).
the CA store.
pki.createCaStore()holds two or morecertificates with the same subject name,
pki.verifyCertificateChain()permanently removes certificates with that subject from the store while
looking for the issuer of a certificate. A peer that sends a certificate
naming that subject as its issuer, even one with an invalid signature,
makes all later verifications of chains issued by those CA certificates
fail, for as long as the store is in use. Verifying valid chains has the
same effect. Verification never incorrectly succeeds because of this.
BigInteger.modInverse()with negative inputs.BigInteger.modInverse()still enters an infinite loop when the value orthe modulus is negative, causing the process to hang indefinitely and
consume 100% CPU. In forge this is reachable when a negative public
exponent
eis passed topki.rsa.generateKeyPair()orpki.rsa.createKeyPairGenerationState(). Keys parsed from DER, PEM or JWKcannot produce negative values. Applications are affected only if they
pass untrusted values as the RSA key generation exponent or call
modInverse()with negative values.Fixed
verification by re-encoding the expected DigestInfo and comparing bytes, as
in RFC 8017 8.2.2. Based on work in PRs by @matthewscottconroy (#1159),
@shaswata56 (#1160), @nitrog7 (#1161), and @RoastFried-RF (#1162).
fromDer()maxDepthrecursion limit when decoding ASN.1from BIT STRING contents. Contents that would exceed the limit are kept as
an undecoded BIT STRING value.
fromDer(). BITSTRINGs inside decoded BIT STRING contents are kept as undecoded BIT STRING
values. Their bytes are unchanged by
toDer().the inner BIT STRING value (after its leading unused bits octet) with
asn1.fromDer(). Common structures such as SubjectPublicKeyInfo only useone level.
Messages are matched as before, except that a BEGIN line's label is the
shortest one followed by
-----(RFC 7468 labels can't contain--).over 39 under 0 or 1, in
asn1.oidToDer().2.999) in base 128. From PR #1148 by @spokodev.number of records in one
process()call no longer affects stack depth.message after failing the connection with an
unexpected_messagealert,instead of throwing a
TypeError.insufficient_securityalertwhen the server sends no certificate, even if the
verifycallbackaccepts it, since the RSA key exchange needs the server certificate.
function
pbe.generatePkcs12Key()(alsopkcs12.generateKey()), used forPKCS#12 MACs and PKCS#12 password-based encryption.
basicConstraintsOID (2.5.29.19) incertificate chain verification, not the deprecated OIDs that are also
parsed as
basicConstraints.basicConstraintspathLenConstraintin chain verificationfor CA certificates without a
keyUsageextension.parameters of its own signature algorithm, using the issuer's public key.
PKCS#1 v1.5 certificates issued by an RSASSA-PSS certificate, and the
reverse, failed verification before.
tagLengthoption. Only the tag lengths defined byNIST SP 800-38D (128, 120, 112, 104, 96, 64, and 32 bits) are allowed;
numeric strings such as
'128'are still accepted. AnullorundefinedtagLengthuses the default of 128 bits.0,false,'',8, or256), which produced empty or non-conformant tags, now throw anerror. A
nullorundefinedtagLength, which produced an empty tagwhen encrypting, now means the default of 128 bits. Data previously
encrypted with an empty tag can no longer be decrypted, since accepting
an empty tag is the authentication bypass.
a count from 1 to the block size, and every padding byte equal to the
count.
XML Encryption padding, used to decrypt because only the last byte was
checked, and now fails. To decrypt it, set
decipher.mode.unpad = falsebefore
finish()and remove the padding in your code.named
__proto__or with the path__proto__.subject when trying each of them as the issuer in
pki.verifyCertificateChain().BigInteger.modInverseto also exit early with zero when thetarget object value or the modulus is negative, completing the 1.4.0 fix
that only checked for zero.
complete, instead of answering them. Previously, unauthenticated peers
could make a connection create and send a heartbeat response for every
request before the handshake, at a significant CPU cost per request.
Configuration
📅 Schedule: (in timezone Europe/Paris)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.