Transport Layer Security Vulnerability in Node-Forge by Digital Bazaar

CVE-2026-118778

What is CVE-2026-118778?

The node-forge library, which implements Transport Layer Security (TLS) in JavaScript, has a vulnerability where the TLS client erroneously checks for the presence of a server certificate. This flaw arises when a malformed TLS server or an on-path attacker fails to send the Certificate message. As a result, the connection could end up processing a non-existent certificate, leading to an uncaught exception that disrupts the connection or aborts the process. This issue is rectified in version 1.4.1, reinforcing the importance of certificate validation within TLS connections.

References