Live › vulnerability › CVE-2026-119187
Forge (node-forge) is a JavaScript TLS library. A remote peer can send thousands of tiny TLS records in one chunk, exhausting the call stack and throwing an uncaught exception that takes down the process (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 20:26 UTC. All times on this page are UTC.
Applications that use node-forge's TLS implementation (forge.tls.createConnection) to accept or process connections from remote peers are exposed. Projects that only use node-forge for hashing, certificates or other non-TLS features, or that run on a fixed version, can skip it.
No product ranges from the sources yet.
npm ls node-forge in the project.forge.tls.createConnection usage in the codebase.1.4.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-119187")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.