CVE-2026-118779
Description
A flaw was found in node-forge. The pem.decode() function uses inefficient regular expressions when parsing Privacy-Enhanced Mail (PEM) data with missing end boundaries or long encapsulated headers. A remote, unauthenticated attacker can exploit this vulnerability by submitting specially crafted PEM input, consuming excessive CPU resources and causing a Denial of Service (DoS).
Statement
Red Hat Product Security rates this vulnerability as Important because an unauthenticated remote attacker can trigger significant CPU consumption and stall service event loops without requiring privileges or user interaction. In affected environments where applications ingest untrusted certificate or key payloads, processing maliciously constructed data can exhaust server resources and disrupt availability for legitimate users. Confidentiality and data integrity remain unaffected, as the weakness cannot be leveraged for remote execution or information exposure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
