Bump node-forge from 1.3.3 to 1.4.0 by dependabot[bot] · Pull Request #6676 · 3liz/lizmap-web-client

dependabot · 2026-03-29T00:56:20Z

Bumps node-forge from 1.3.3 to 1.4.0.

Changelog

1.4.0 - 2026-03-24

Security

HIGH: Denial of Service in BigInteger.modInverse()

A Denial of Service (DoS) vulnerability exists due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU.

Reported by Kr0emer.

CVE ID: CVE-2026-33891

GHSA ID: GHSA-5gfm-wpxj-wjgq

HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field.

RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing "garbage" bytes within the ASN.1 structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN.1 structure, rather than outside of it.

Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33894

GHSA ID: GHSA-ppp5-5v6c-4jwp

HIGH: Signature forgery in Ed25519 due to missing S < L check.

Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (S >= L). A valid signature and its S + L variant both verify in forge, while Node.js crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33895

GHSA ID: GHSA-q67f-28xg-22rw

HIGH: basicConstraints bypass in certificate chain verification.

pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.

Reported by Doruk Tan Ozturk (@peaktwilight) - doruk.ch

CVE ID: CVE-2026-33896

GHSA ID: GHSA-2328-f5f3-gj25

... (truncated)

Commits

fa385f9 Release 1.4.0.
07d4e16 Update changelog.
cb90fd9 Update changelog.
963e7c5 Add unit test for "pseudonym"
f0b6f5b Add pseudonym OID
3df48a3 Fix missing CVE ID.
2e49283 Add x509 basicConstraints check.
bdecf11 Add canonical signature scaler check for S < L.
af094e6 Add RSA padding and DigestInfo length checks.
796eeb1 Improve jsbn fix.
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.3 to 1.4.0. - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.3...v1.4.0) --- updated-dependencies: - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-03-29T01:15:57Z

All Playwright tests STABLE

Summary

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Other ❓	Flaky 🍂	Duration ⏱️
538	534	2	2	0	10	16m 22s

Failed Tests

Failed Tests ❌	Fail Message
❌ WFS GetFeature shop_bakery for user_in_group_a	Error: expect(received).toHaveLength(expected) Expected length: 5 Received length: 4 Received array: [{"geometry": {"coordinates": [3.811568, 43.653714], "type": "Point"}, "id": "shop_bakery.1", "properties": {"id": 16, "polygon_id": 0}, "type": "Feature"}, {"geometry": {"coordinates": [3.878482, 43.655109], "type": "Point"}, "id": "shop_bakery.8", "properties": {"id": 103, "polygon_id": 1}, "type": "Feature"}, {"geometry": {"coordinates": [3.89268, 43.656244], "type": "Point"}, "id": "shop_bakery.9", "properties": {"id": 119, "polygon_id": 1}, "type": "Feature"}, {"geometry": {"coordinates": [3.894293, 43.572141], "type": "Point"}, "id": "shop_bakery.17", "properties": {"id": 163, "polygon_id": 4}, "type": "Feature"}]

Flaky Tests

Flaky Tests 🍂	Retries
popup_bar users of point 2	1
WFS GetFeature blue_filter_layer_by_user for admin	1
WFS GetFeature townhalls_EPSG2154 for user_in_group_a	1
WFS GetFeature townhalls_EPSG2154 for admin	1
Base layers list	1
#2 Layer export with user_in_group_a user logged in	2
Catch GetLegendGraphic requests and timeout on GetLegendGraphic with multi layers	1
Switcher from map to map	1
Build permalink, reload and apply one	1
Print requests with redlining	1

Flaky Rate

Overall Flakiness	2.00% ±0

Test 📝	Flaky Attempts 🍂	Total Attempts 🎯	Flaky Rate (%) 📈
#2 Layer export with user_in_group_a user logged in	2	4	50.00 ↑50.00
popup_bar users of point 2	1	2	50.00 ↑50.00
WFS GetFeature blue_filter_layer_by_user for admin	1	2	50.00 ↑50.00
WFS GetFeature townhalls_EPSG2154 for user_in_group_a	1	2	50.00 ↑50.00
WFS GetFeature townhalls_EPSG2154 for admin	1	2	50.00 ↑50.00
#2 Layer export with user_in_group_a user logged in	2	4	50.00 ↑50.00
Catch GetLegendGraphic requests and timeout on GetLegendGraphic with multi layers	1	2	50.00 ↑50.00
Switcher from map to map	1	2	50.00 ↑50.00
Build permalink, reload and apply one	1	2	50.00 ↑50.00
Print requests with redlining	1	2	50.00 ↑50.00
Base layers list	1	5	20.00 ↑20.00
Base layers list	1	5	20.00 ↑20.00
Base layers list	1	5	20.00 ↑20.00
Base layers list	1	5	20.00 ↑20.00

Github Test Reporter by CTRF 💚

All Playwright tests LEGACY

Summary

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Other ❓	Flaky 🍂	Duration ⏱️
538	535	1	2	0	7	16m 23s

Failed Tests

Failed Tests ❌	Fail Message

Flaky Tests

Flaky Tests 🍂	Retries
Axis Orientation NEU for EPSG:3044	1
Popup with map click & attribute table	1
Default	1
Filter uses full ISO dates despite years resolution	1
Switcher from map to map	1
Build permalink, reload and apply one	1
Children are placed in the correct div container	1

Flaky Rate

Overall Flakiness	1.28% ±0

Test 📝	Flaky Attempts 🍂	Total Attempts 🎯	Flaky Rate (%) 📈
Axis Orientation NEU for EPSG:3044	1	2	50.00 ↑50.00
Filter uses full ISO dates despite years resolution	1	2	50.00 ↑50.00
Switcher from map to map	1	2	50.00 ↑50.00
Build permalink, reload and apply one	1	2	50.00 ↑50.00
Children are placed in the correct div container	1	2	50.00 ↑50.00
Popup with map click & attribute table	1	4	25.00 ↑25.00
Popup with map click & attribute table	1	4	25.00 ↑25.00
Popup with map click & attribute table	1	4	25.00 ↑25.00
Default	1	4	25.00 ↑25.00
Default	1	4	25.00 ↑25.00
Default	1	4	25.00 ↑25.00

Github Test Reporter by CTRF 💚

All Playwright tests BLEEDING_EDGE

Summary

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Other ❓	Flaky 🍂	Duration ⏱️
538	535	1	2	0	8	16m 12s

Failed Tests

Failed Tests ❌	Fail Message

Flaky Tests

Flaky Tests 🍂	Retries
WFS GetFeature shop_bakery_pg for admin	1
Axis Orientation NEU for EPSG:3844	1
Check attribute table editable features - anonymous	1
Popup with map click & attribute table	1
Check lizmap feature toolbar	1
Catch GetLegendGraphic requests and timeout on GetLegendGraphic with multi layers	1
Switcher from map to map	1
Print requests with redlining	1

Flaky Rate

Overall Flakiness	1.47% ±0

Test 📝	Flaky Attempts 🍂	Total Attempts 🎯	Flaky Rate (%) 📈
WFS GetFeature shop_bakery_pg for admin	1	2	50.00 ↑50.00
Axis Orientation NEU for EPSG:3844	1	2	50.00 ↑50.00
Check attribute table editable features - anonymous	1	2	50.00 ↑50.00
Check lizmap feature toolbar	1	2	50.00 ↑50.00
Catch GetLegendGraphic requests and timeout on GetLegendGraphic with multi layers	1	2	50.00 ↑50.00
Switcher from map to map	1	2	50.00 ↑50.00
Print requests with redlining	1	2	50.00 ↑50.00
Popup with map click & attribute table	1	4	25.00 ↑25.00
Popup with map click & attribute table	1	4	25.00 ↑25.00
Popup with map click & attribute table	1	4	25.00 ↑25.00

Github Test Reporter by CTRF 💚

3liz-bot · 2026-03-30T07:33:25Z

The backport to release_3_9 failed:

The process '/usr/bin/git' failed with exit code 1

stderr

error: could not apply 517b138d7... Bump node-forge from 1.3.3 to 1.4.0
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

stdout

Auto-merging package-lock.json
CONFLICT (content): Merge conflict in package-lock.json

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-release_3_9 release_3_9
# Navigate to the new working tree
cd .worktrees/backport-release_3_9
# Create a new branch
git switch --create backport-6676-to-release_3_9
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick 517b138d769e18d4dff6eace0db5f90d00b18820
# Push it to GitHub
git push --set-upstream origin backport-6676-to-release_3_9
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-release_3_9

Then, create a pull request where the base branch is release_3_9 and the compare/head branch is backport-6676-to-release_3_9.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 29, 2026

github-actions bot added this to the 3.11.0 milestone Mar 29, 2026

rldhont added backport release_3_9 backport release_3_10 labels Mar 30, 2026

rldhont merged commit d82cd03 into master Mar 30, 2026
18 of 19 checks passed

rldhont deleted the dependabot/npm_and_yarn/node-forge-1.4.0 branch March 30, 2026 07:33

3liz-bot added the failed backport label Mar 30, 2026

3liz-bot mentioned this pull request Mar 30, 2026

[Backport release_3_10] Bump node-forge from 1.3.3 to 1.4.0 #6677

Merged

rldhont mentioned this pull request Mar 30, 2026

[Backport release_3_9] Bump node-forge from 1.3.3 to 1.4.0 #6678

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump node-forge from 1.3.3 to 1.4.0#6676

Bump node-forge from 1.3.3 to 1.4.0#6676
rldhont merged 1 commit intomasterfrom
dependabot/npm_and_yarn/node-forge-1.4.0

dependabot bot commented on behalf of github Mar 29, 2026

Uh oh!

github-actions bot commented Mar 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

3liz-bot commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 29, 2026

1.4.0 - 2026-03-24

Security

Uh oh!

github-actions bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

All Playwright tests STABLE

Summary

Failed Tests

Flaky Tests

Flaky Rate

All Playwright tests LEGACY

Summary

Failed Tests

Flaky Tests

Flaky Rate

All Playwright tests BLEEDING_EDGE

Summary

Failed Tests

Flaky Tests

Flaky Rate

Uh oh!

Uh oh!

3liz-bot commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Mar 29, 2026 •

edited

Loading