Live › vulnerability › CVE-2026-118778
node-forge is a JavaScript TLS implementation whose client checked the wrong property for a missing server certificate. A malicious TLS server or on-path peer can omit the Certificate message and crash the connection or the Node process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications that use node-forge's TLS client (forge.tls.createConnection) to connect to servers, including through dependencies. Exposure requires connecting to a hostile or attacker-positioned TLS server; applications that only use node-forge for hashing or certificate parsing, or that do not make TLS client connections with it, are not affected by this flaw.
No product ranges from the sources yet.
npm ls node-forge to list every installed copy and its versionforge.tls.createConnection in your code or dependencies that use TLS client mode1.4.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118778")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.