Vulnerabilities

Security fix · CVE-2026-118782

Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · Forge: PKCS#12 MAC forgery

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-118782. EPSS is 0.13%. Act only if a listed version of Forge: PKCS#12 MAC forgery is installed.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.13%

Remediation

Version ranges on file

Affected products

npm node-forge

### Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and the PKCS#12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS#12/PFX file and compute a MAC that verifies with any password; PKCS#12 PBE-encrypted private keys prepared the same way decrypt with any password. Fixed in node-forge 1.4.1. ### Details in reads the MAC iteration count ( ) from the input and passes it to the PKCS#12 key derivation function in (also exposed as ) without checking that it is at least 1. The key derivation function (RFC 7292 Appendix B.2) runs its hash loop times. With an iteration count of 0 (or an empty or negative INTEGER), no hashing is done and the function returns the PKCS#12 diversifier ID byte repeated, for example repeated 20 times for an HMAC-SHA1 MAC key. The result does not depend on the password or the salt, so anyone can compute a valid MAC over arbitrary PFX contents. The same key derivation function is used by for the PKCS#12 password-based encryption schemes and , whose iteration count is also read from the input. With an iteration count of 0 or less, the encryption key and IV are constants ( and repeated). This is reached from shrouded key bags and encrypted SafeContents in , and from (for example for PEM input). RFC 7292 defines with ; an iteration count only makes sense as 1 or more (RFC 8018 uses for the same concept). PBES2 (PBKDF2) encrypted content is not affected. The fix rejects iteration counts less than 1 when verifying a PKCS#12 MAC in ("PKCS#12 MAC iteration count must be >= 1.") and at the entry of ("PKCS#12 key derivation iteration count must be >= 1."), which covers the MAC, both PKCS#12 PBE schemes and direct callers. ### Patches Fixed in node-forge 1.4.1. Iteration counts less than 1 are now rejected when verifying a PKCS#12 MAC and in the PKCS#12 key derivation function. ### Workaroun