Live › vulnerability › CVE-2026-119188
node-forge is a JavaScript TLS library. A remote peer can interleave TLS record types inside a fragmented handshake, causing an uncaught TypeError that crashes the connection or the process hosting it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 20:26 UTC. All times on this page are UTC.
Applications that use node-forge's TLS implementation (forge.tls.createConnection()) to accept or make connections to untrusted peers are exposed, because a remote peer can crash the process. Projects that only use node-forge for hashing, ciphers or certificate utilities, or that do not use its TLS code, are not affected by this flaw.
No product ranges from the sources yet.
npm ls node-forge in each projectforge.tls.createConnection() in application code1.4.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-119188")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.