Transport Layer Security Vulnerability in node-forge by Digital Bazaar

CVE-2026-119188

What is CVE-2026-119188?

node-forge, a JavaScript implementation of Transport Layer Security, contains a vulnerability that arises from improper handling of fragmented handshake messages. Prior to version 1.4.1, the library allowed for the processing of data from different content types simultaneously, leading to potential uncaught TypeErrors during the connection process. This flaw could be triggered by a remote peer, resulting in the connection or hosting process crashing. Users are encouraged to update to version 1.4.1 or later to mitigate this issue.

References