Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

digitalbazaar/forge

              main @ 7a43db9
            

Fixes

CVEs

CRITICAL

Peak severity

55.6%

Coverage

Highlights

Denial of Service: 12 prior fixes. Scrutinize any change in this area.

js/tls.js: most-fixed (21 issues). Treat as high-risk during review.

28 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass certificate validation by presenting leaf certificates as Certificate Authorities when the basicConstraints extension is not properly validated, violating RFC 5280.

Signature Forgery: Lenient parsing of RSASSA-PKCS1-V1_5 structures and DigestInfo ASN.1 data enables Bleichenbacher-style signature forgery, particularly when low public exponents are utilized.

Denial of Service: The modular inverse function (bnModInverse) is susceptible to infinite loops and complete CPU exhaustion if zero inputs are not explicitly validated and rejected early.