[dependabot]

Bumps the prod-dependencies group with 2 updates in the / directory: node-forge and tar-stream.

Updates node-forge from 1.4.0 to 1.4.2

Changelog

Sourced from node-forge's changelog.

1.4.2 - 2026-10-27

Fixed

• [pem] Convert non-string input to a string in pem.decode() as before 1.4.1. The 1.4.1 PEM ReDoS fix (GHSA-7wch-p9px-956x) caused a TypeError for Buffer input, which is used by node-jose. (#1165)

1.4.1 - 2026-10-27

Notes

• This release involved coordinating many security reports from many groups, people, and robots over too long period of time. Thank you for your reports and patience.
• Claude Code was used to help organize, track, untangle, merge, test, validate, fix, and improve it all. Further verification of fixes would be welcome.
• Tracking credits was challenging for some issues due to multiple email and GitHub reports, incomplete contact details, or combining of partial reports and fixes. Please let us know if there are credits changes needed here or in advisory data.

Security

• HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field in DigestAlgorithm.
  • RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). The fix for CVE-2026-33894 only checked the element count of the outer DigestInfo. Attackers can add "garbage" elements inside the nested DigestAlgorithm SEQUENCE in order to construct a signature that passes verification, enabling Bleichenbacher style forgery.
  • Reported by Geo (@​geo-chen).
  • CVE ID: CVE-2026-85393
  • GHSA ID: GHSA-2g46-22mc-6gwp
• HIGH: Signature forgery in RSA-PKCS due to non-canonical DigestInfo encoding.
  • RSASSA PKCS#1 v1.5 signature verification accepts non-canonical DigestInfo encodings, such as NULL parameters with content, non-minimal length encodings, and non-canonical OIDs. These provide attackers space to construct forged signatures for low public exponent keys (e=3), similar to CVE-2026-33894 and CVE-2026-85393.
  • Reported by Oren Yomtov (@​orenyomtov, Fireblocks), Bronson Yen (Calif.io, in collaboration with Claude and Anthropic Research), Kamil Hałajda, @​pzartech, @​antonlissone, and @​Brechard.
  • CVE ID: CVE-2026-119192
  • GHSA ID: GHSA-6qrw-m8cv-hcxf
• HIGH: ASN.1 resource exhaustion via BIT STRING decoding.
  • An Uncontrolled Recursion (CWE-674) and Uncontrolled Resource Consumption (CWE-400) vulnerability in node-forge versions 1.4.0 and below enables remote, unauthenticated attackers to exhaust CPU and memory with small crafted DER or PEM inputs (certificates, keys, and other structures parsed

... (truncated)

Commits

• 7928054 Release 1.4.2.
• 1d8c245 Update changelog.
• ce5b576 Convert non-string input in pem.decode().
• c1d64ef Fix changelog typo.
• 453d196 Start 1.4.2-0.
• 8a91737 Release 1.4.1.
• fdd1b9f Update changelog.
• 4c1c3e3 Add changelog release notes.
• 0b455eb Ignore TLS heartbeat requests before the handshake.
• e96c47b Fix jsbn modInverse hang with negative inputs.
• Additional commits viewable in compare view

Updates tar-stream from 3.2.0 to 3.2.2

Commits

• d49f05b 3.2.2
• 5992b92 bump deps
• 246572f 3.2.1
• 5aa24f7 Add TypeScript typings (#179)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions