Transport Layer Security Vulnerability in Forge - Digital Bazaar

CVE-2026-125334

What is CVE-2026-125334?

Forge, a JavaScript implementation of Transport Layer Security, contains a vulnerability where a forge.tls client can incorrectly handle a handshake record when no session exists. This may occur under various conditions such as after a close_notify alert or prior to initiating a handshake. As a result, the handler dereferences an invalid session property, leading to a TypeError from connection.process(). An attacker capable of sending manipulated records could exploit this, potentially terminating the Node.js application if the error is unhandled. This issue has been addressed in version 1.4.3.

References