{"id":"CVE-2026-119187","kind":"vulnerability","aliases":["CVE-2026-119187"],"related":[],"title":"node-forge: TLS record handling lets a remote peer crash the process","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.","summary":"Forge (node-forge) is a JavaScript TLS library. A remote peer can send thousands of tiny TLS records in one chunk, exhausting the call stack and throwing an uncaught exception that takes down the process (denial of service).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node-forge","node.js","package","tls"],"not_affected_if":["no-forge-tls-usage","version-1.4.1-or-later"],"how_to_check":"- Check the installed version with `npm ls node-forge` in the project.\n- Look for `forge.tls.createConnection` usage in the codebase.","fix":"- Upgrade node-forge to `1.4.1` or later.","status":"open","published_at":"2026-10-29T20:17:29+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","triaged_at":"2026-10-29T20:28:05+00:00","updated_at":"2026-10-29T20:28:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T20:28:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade node-forge to `1.4.1` or later.","reach":"network","title":"node-forge: TLS record handling lets a remote peer crash the process","impact":"low","summary":"Forge (node-forge) is a JavaScript TLS library. A remote peer can send thousands of tiny TLS records in one chunk, exhausting the call stack and throwing an uncaught exception that takes down the process (denial of service).","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","node-forge","tls"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"remote peer crashes the process with an uncaught exception","analyst_note":"","how_to_check":"- Check the installed version with `npm ls node-forge` in the project.\n- Look for `forge.tls.createConnection` usage in the codebase.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.4.1-or-later","no-forge-tls-usage"],"who_is_affected":"Applications that use node-forge's TLS implementation (forge.tls.createConnection) to accept or process connections from remote peers are exposed. Projects that only use node-forge for hashing, certificates or other non-TLS features, or that run on a fixed version, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4196,"output_tokens":482,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119187':16A,19A '-2026':15A,18A '1.4.1':83C,150C 'affect':85C 'also':66C 'call':50B,67C,134C 'caus':136C 'chunk':47B,120C 'consum':109C 'could':124C 'crash':11A 'cve':14A,17A 'decis':100C 'denial':62B,141C 'except':56B,139C 'exhaust':48B,132C 'fix':147C 'forg':3A,22B,26B,29B,65C,70C,103C 'forge.tls.createconnection':88C 'frame':113C 'handl':6A 'implement':74C,86C 'input':97C,119C 'issu':145C 'javascript':32B,80C,111C 'layer':77C 'let':7A 'librari':34B 'nativ':73C 'node':2A,21B,28B,69C,102C 'node-forg':1A,20B,27B,68C,101C 'node.js':23B 'one':46B,110C 'packag':24B 'peer':10A,37B,123C 'per':114C 'prior':81C 'process':13A,61B,91C,92C,94C,104C 'receiv':105C 'record':5A,44B,90C,107C,115C,129C 'recurs':108C 'relev':96C 'remot':9A,36B,122C 'secur':78C,99C 'send':39B,125C 'servic':64B,143C 'singl':118C 'small':128C 'stack':51B,112C,135C 'take':58B 'thousand':40B,126C 'throw':53B 'tini':42B 'tls':4A,25B,33B,43B,89C,106C 'togeth':130C 'transport':76C 'uncaught':55B,138C 'use':87C 'version':149C","nicknames":[],"mitigations":[],"who_affected":"Applications that use node-forge's TLS implementation (forge.tls.createConnection) to accept or process connections from remote peers are exposed. Projects that only use node-forge for hashing, certificates or other non-TLS features, or that run on a fixed version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T20:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119187","severity":null,"published_at":"2026-10-29T20:17:29+00:00","modified_at":"2026-10-29T20:17:29+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","fetched_at":"2026-10-29T20:26:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}