---
title: node-forge 1.4.1 fixes AES-GCM check that accepts any ciphertext when tagLength converts to zero (CVE-2026-119186) | ctxsec
url: https://ctxsec.com/items/node-forge-1-4-1-cve-2026-119186-aes-gcm-taglength-zero-auth-bypass
description: "In node-forge 1.4.0 and earlier, an AES-GCM tagLength of 0 or a falsy value such as null, false or '' produced an empty tag, so decipher.finish() returned true for any ciphertext. Fixed in 1.4.1, which only allows NIST tag lengths. Rated 5.9 because the app must pass the bad option."
status: "official advisory (GitHub advisory GHSA-5cwg-6vw7-rj6p, Oct 30); rated medium 5.9; no exploitation reported"
published: 2026-10-31
---

> In node-forge 1.4.0 and earlier, an AES-GCM tagLength of 0 or a falsy value such as null, false or '' produced an empty tag, so decipher.finish() returned true for any ciphertext. Fixed in 1.4.1, which only allows NIST tag lengths. Rated 5.9 because the app must pass the bad option.

[← Cybersecurity News](/news) · [markdown](/items/node-forge-1-4-1-cve-2026-119186-aes-gcm-taglength-zero-auth-bypass.md)

official advisory (GitHub advisory GHSA-5cwg-6vw7-rj6p, Oct 30); rated medium 5.9; no exploitation reported

2026-10-31

### node-forge 1.4.1 fixes AES-GCM check that accepts any ciphertext when tagLength converts to zero (CVE-2026-119186)

A GitHub advisory published **Oct 30** covers an authentication bypass in the AES-GCM mode of **node-forge**, the widely used pure-JavaScript crypto library on npm.

- **Bug:** `start()` stored the `tagLength` option without validation. A value that converts to 0 (`0`, `null`, `false`, `''`, `'0'`) made the tag truncation compute `16 % 0 = NaN` and empty the tag, so `decipher.finish()` returned `true` for any ciphertext and additional data.
- **Affected:** node-forge 1.4.0 and earlier. **Fixed:** 1.4.1, where `start()` throws unless the tag length is one NIST SP 800-38D allows (128, 120, 112, 104, 96, 64 or 32 bits). Missing or `null` uses the 128-bit default.
- **Severity:** medium, CVSS 5.9, because exploitation needs the application to pass an attacker-influenced or falsy `tagLength`.

**What to do:** upgrade to 1.4.1 (check transitive dependencies with `npm ls node-forge`), and set `tagLength` explicitly rather than passing it through from config or user input.

Sources: [GitHub advisory GHSA-5cwg-6vw7-rj6p (Oct 30)](https://github.com/advisories/GHSA-5cwg-6vw7-rj6p)