Transport Layer Security Vulnerability in Forge by Digital Bazaar

CVE-2026-125332

What is CVE-2026-125332?

A vulnerability in Forge, a JavaScript implementation of Transport Layer Security, allows a malicious server or an on-path attacker to manipulate the ServerHello compression method, which the client does not support. If the client, during the TLS handshake process, encounters an unsupported compression method without proper exception handling, this can lead to a termination of the Node.js process. The issue arises specifically when using forge.tls client methods, including forge.tls.wrapSocket, and forge.http. It's important to note that the vulnerability does not affect forge.tls servers and poses no risk to confidentiality or integrity. The problem has been resolved in version 1.4.3.

References