Back to Explore

digitalbazaar/forge

GitHub
3 updates · last 90 daysOpen source

Last release:

Forge is a native JavaScript implementation of the TLS protocol, along with a collection of cryptography utilities and tools for building web apps that use many network resources. It’s useful for developers who need TLS client and server features in JavaScript, plus supporting crypto capabilities like X.509 and common PKCS standards, message digests, and ciphers.

Project status

  • The source appears actively maintained now, with an upstream push and an update on November 4, 2026.
  • Cadence is uneven: after a long gap from March 2022 to November 2025, updates arrived in late 2025 and then several times in October and November 2026.

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • v1.4.3

    v1.4.3 contains security hardening across X.509 certificate validation, Ed25519 signature verification, TLS handshakes, and HTTP response parsing. The publisher provided no release notes, although the updated CHANGELOG.md describes these changes.

    BreakingSecurityFeatures

  • v1.4.2

    Forge v1.4.2 fixes a regression in `pem.decode()` that caused a TypeError when callers passed non-string input such as a Buffer. No publisher release notes were provided; the diff's CHANGELOG documents the fix.

  • v1.4.1

    node-forge v1.4.1 is primarily a security and robustness release, with fixes across ASN.1, PEM, RSA verification, TLS, PKCS#12, and certificate-chain validation. The publisher supplied no release notes, although the diff adds a detailed CHANGELOG.md describing many of these fixes.

    BreakingSecurity

  • v1.4.0

    node-forge v1.4.0 introduces multiple security hardening changes in cryptographic verification code (RSA PKCS#1 v1.5, Ed25519, BigInteger/jsbn) and stricter certificate chain validation (basicConstraints enforcement). It also adds support for the OID 2.5.4.65 (pseudonym) and updates the bundled jsbn code to a newer synced variant.

    BreakingSecurityFeatures

  • v1.3.3

    Release v1.3.3 contains a small PKCS#12 parsing fix. There were no publisher-provided release notes in the input, so the only observable changes come directly from the code diff.

  • v1.3.2

    Release v1.3.2 was published on 2025-11-25, but the publisher did not include any release notes. No documented changes, bug fixes, security updates, or migration guidance are available in the provided data.

  • v1.3.1

    v1.3.1 makes a targeted change to RSA RSASSA-PKCS1-v1_5 DigestInfo validation, specifically around whether DigestAlgorithm NULL parameters are required or optional. No release notes were provided for this version, but the changelog and code changes indicate behavioral enforcement changes for md2 and md5 during signature verification.

  • v1.3.0

    v1.3.0 introduces significantly stricter DER parsing and RSA PKCS#1 v1.5 signature verification behavior. The changes primarily tighten ASN.1 parsing (defaulting to consuming all input bytes) and enforce stricter DigestInfo structure and digest algorithm validation during verification.

    SecurityFeatures

  • v1.2.1

    Release v1.2.1 contains small internal fixes. Code changes focus on test loading and a refactor to the browser URL query parsing used for console log level overrides.

  • v1.2.0

    Release v1.2.0 refactors X.509 signature digest computation and signature verification logic, and it adds support for an additional SHA-1 with RSA signature OID alias. It also corrects the assignment of expected vs actual issuer fields in a certificate issuance verification error. Release notes were not provided by the publisher, so the code changes below are not documented in the provided release notes.

  • v1.1.0

    v1.1.0 includes targeted fixes around PEM decoding of certificate requests and X.509 certificate hashing. The provided publisher release notes are empty, but the changelog and code changes indicate behavior adjustments in PEM CSR label handling and in how cert.issuer.hash and cert.subject.hash are computed.

  • v1.0.0

    No publisher release notes were provided for v1.0.0 (the release_notes block states none were provided). The code diff shows a major v1.0.0 refactor, most notably removing several previously exposed utility/debug/task APIs and switching HTTP/XHR URL handling to the WHATWG `URL` standard.

    SecurityFeatures

  • 0.10.0

    Release 0.10.0 was published on 2020-09-02, but the publisher provided no release notes. As a result, there is not enough documented information to identify new features, breaking changes, bug fixes, security updates, performance improvements, or migration requirements.