Denial of Service Vulnerability in Node-Forge TLS Implementation
CVE-2026-119187

7.5HIGH

Key Information:

Vendor

Digitalbazaar

Status
Forge
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119187?

Node-Forge, a JavaScript implementation of Transport Layer Security, had a vulnerability in its TLS record processing that could lead to a denial of service. Prior to version 1.4.1, the library processed received TLS records recursively, resulting in the consumption of one JavaScript stack frame for each record. A remote attacker could exploit this flaw by sending numerous small TLS records in a single input chunk, potentially exhausting the call stack and causing an uncaught exception. This vulnerability has been addressed in version 1.4.1.

Affected Version(s)

forge < 1.4.1

References

https://github.com/digitalbazaar/forge/security/advisorie...
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/commit/817e2ce0d0f...
x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.