Security Flaw in Node-Forge Affecting AES-GCM Decryption

CVE-2026-119186

What is CVE-2026-119186?

Node-Forge, a JavaScript implementation of TLS, has a vulnerability where it fails to validate the AES-GCM tagLength option during decryption operations. This oversight allows unauthenticated ciphertext to be accepted by decipher.finish() when certain conditions are met, such as a derived tagLength resulting in a zero value and an absent or empty authentication tag. This could lead to significant security risks, particularly for applications that do not explicitly specify the tagLength or use it as a default without proper validation. The issue has been addressed in version 1.4.1.

References