{"id":"CVE-2026-119188","kind":"vulnerability","aliases":["CVE-2026-119188"],"related":[],"title":"node-forge: crafted TLS records can crash a Node.js TLS process","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.","summary":"node-forge is a JavaScript TLS library. A remote peer can interleave TLS record types inside a fragmented handshake, causing an uncaught TypeError that crashes the connection or the process hosting it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node-forge","node.js","package","tls"],"not_affected_if":["client-only-trusted-peers","no-forge-tls-use"],"how_to_check":"- Check the installed node-forge version with `npm ls node-forge` in each project\n- Look for uses of `forge.tls.createConnection()` in application code\n- Confirm whether node-forge is pulled in as a dependency of another package","fix":"- node-forge: `1.4.1` or later","status":"open","published_at":"2026-10-29T20:17:29+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","triaged_at":"2026-10-29T20:28:06+00:00","updated_at":"2026-10-29T20:28:06+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T20:28:06Z","model":"claude-haiku-5-5","output":{"fix":"- node-forge: `1.4.1` or later","reach":"network","title":"node-forge: crafted TLS records can crash a Node.js TLS process","impact":"low","summary":"node-forge is a JavaScript TLS library. A remote peer can interleave TLS record types inside a fragmented handshake, causing an uncaught TypeError that crashes the connection or the process hosting it.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","javascript","tls","node-forge"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"remote peer crashes the connection or hosting process","analyst_note":"","how_to_check":"- Check the installed node-forge version with `npm ls node-forge` in each project\n- Look for uses of `forge.tls.createConnection()` in application code\n- Confirm whether node-forge is pulled in as a dependency of another package","plain_action":"","needs_analyst":false,"not_affected_if":["no-forge-tls-use","client-only-trusted-peers"],"who_is_affected":"Applications that use node-forge's TLS implementation (forge.tls.createConnection()) to accept or make connections to untrusted peers are exposed, because a remote peer can crash the process. Projects that only use node-forge for hashing, ciphers or certificate utilities, or that do not use its TLS code, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4192,"output_tokens":518,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119188':15A,18A '-2026':14A,17A '1.4.1':76C,137C 'affect':78C 'also':59C 'anoth':105C 'call':60C 'caus':46B,123C 'connect':53B,125C 'content':106C 'continu':98C 'could':116C 'craft':4A 'crash':8A,51B 'cve':13A,16A 'decis':94C 'fail':130C 'fix':134C 'forg':3A,22B,28B,58C,63C,97C 'forge.tls.createconnection':81C 'fragment':44B,82C,110C 'handshak':45B,83C,111C 'host':57B,127C 'implement':67C,79C 'input':91C 'insid':42B 'interleav':38B,85C 'interrupt':108C 'issu':132C 'javascript':19B,31B,73C 'layer':70C 'librari':33B 'messag':84C,112C 'nativ':66C 'node':2A,21B,27B,62C,96C 'node-forg':1A,20B,26B,61C,95C 'node.js':10A,23B 'packag':24B 'peer':36B,115C 'prior':74C 'process':12A,56B,88C,99C,122C,128C 'record':6A,40B,86C,103C 'relev':90C 'remot':35B,114C 'secur':71C,93C 'tls':5A,11A,25B,32B,39B,102C 'transport':69C 'trigger':117C 'type':41B,107C 'typeerror':49B,120C 'uncaught':48B,119C 'use':80C 'version':136C","nicknames":[],"mitigations":[],"who_affected":"Applications that use node-forge's TLS implementation (forge.tls.createConnection()) to accept or make connections to untrusted peers are exposed, because a remote peer can crash the process. Projects that only use node-forge for hashing, ciphers or certificate utilities, or that do not use its TLS code, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T20:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119188","severity":null,"published_at":"2026-10-29T20:17:29+00:00","modified_at":"2026-10-29T20:17:29+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","fetched_at":"2026-10-29T20:26:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}