node-forge 1.4.1 fixes five high-severity flaws; follow-redirects CVE-2026-116689

node-forge (npm): five advisories fixed in 1.4.1

• What: Five issues in node-forge up to and including 1.4.0: an X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs (CVE-2026-119190), PKCS#12 MAC forgery and constant-key PBE when the iteration count is zero (CVE-2026-118782), two TLS record-processing denial-of-service bugs (CVE-2026-119188, CVE-2026-119187), and a regular-expression denial of service in pem.decode (CVE-2026-118779).
• Severity: High (CVSS 3.x 7.4 for the certificate-chain bypass, 7.5 for the others).
• Exploited: No known exploitation; not on CISA KEV.
• Fixed in: node-forge 1.4.1.
• What to do: Check lockfiles for node-forge (it is often a transitive dependency of dev servers and certificate tooling) and upgrade to 1.4.1. Treat certificate validation done with forge as untrusted until upgraded.

follow-redirects (npm): CVE-2026-116689

• What: Cross-realm sensitiveHeaders arrays are discarded, so custom credentials can be forwarded on redirects to another host (GHSA-mrwp-f3q8-3g9p).
• Severity: High (CVSS 4.0 8.2; CVSS 3.x 5.9).
• Exploited: No known exploitation; not on CISA KEV.
• Fixed in: follow-redirects 1.16.2 (affects 1.16.0 to 1.16.1).
• What to do: follow-redirects is pulled in by popular HTTP clients such as axios. Refresh lockfiles so it resolves to 1.16.2 or later, and avoid sending credentials in custom headers to endpoints that redirect.