[dependabot]

Bumps node-forge from 1.4.0 to 1.4.2.

Changelog

Sourced from node-forge's changelog.

1.4.2 - 2026-10-27

Fixed

• [pem] Convert non-string input to a string in pem.decode() as before 1.4.1. The 1.4.1 PEM ReDoS fix (GHSA-7wch-p9px-956x) caused a TypeError for Buffer input, which is used by node-jose. (#1165)

1.4.1 - 2026-10-27

Notes

• This release involved coordinating many security reports from many groups, people, and robots over too long period of time. Thank you for your reports and patience.
• Claude Code was used to help organize, track, untangle, merge, test, validate, fix, and improve it all. Further verification of fixes would be welcome.
• Tracking credits was challenging for some issues due to multiple email and GitHub reports, incomplete contact details, or combining of partial reports and fixes. Please let us know if there are credits changes needed here or in advisory data.

Security

• HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field in DigestAlgorithm.
  • RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). The fix for CVE-2026-33894 only checked the element count of the outer DigestInfo. Attackers can add "garbage" elements inside the nested DigestAlgorithm SEQUENCE in order to construct a signature that passes verification, enabling Bleichenbacher style forgery.
  • Reported by Geo (@​geo-chen).
  • CVE ID: CVE-2026-85393
  • GHSA ID: GHSA-2g46-22mc-6gwp
• HIGH: Signature forgery in RSA-PKCS due to non-canonical DigestInfo encoding.
  • RSASSA PKCS#1 v1.5 signature verification accepts non-canonical DigestInfo encodings, such as NULL parameters with content, non-minimal length encodings, and non-canonical OIDs. These provide attackers space to construct forged signatures for low public exponent keys (e=3), similar to CVE-2026-33894 and CVE-2026-85393.
  • Reported by Oren Yomtov (@​orenyomtov, Fireblocks), Bronson Yen (Calif.io, in collaboration with Claude and Anthropic Research), Kamil Hałajda, @​pzartech, @​antonlissone, and @​Brechard.
  • CVE ID: CVE-2026-119192
  • GHSA ID: GHSA-6qrw-m8cv-hcxf
• HIGH: ASN.1 resource exhaustion via BIT STRING decoding.
  • An Uncontrolled Recursion (CWE-674) and Uncontrolled Resource Consumption (CWE-400) vulnerability in node-forge versions 1.4.0 and below enables remote, unauthenticated attackers to exhaust CPU and memory with small crafted DER or PEM inputs (certificates, keys, and other structures parsed

... (truncated)

Commits

• 7928054 Release 1.4.2.
• 1d8c245 Update changelog.
• ce5b576 Convert non-string input in pem.decode().
• c1d64ef Fix changelog typo.
• 453d196 Start 1.4.2-0.
• 8a91737 Release 1.4.1.
• fdd1b9f Update changelog.
• 4c1c3e3 Add changelog release notes.
• 0b455eb Ignore TLS heartbeat requests before the handshake.
• e96c47b Fix jsbn modInverse hang with negative inputs.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.

[dependabot]

Looks like node-forge is up-to-date now, so this is no longer needed.