{"id":"CVE-2026-125332","kind":"vulnerability","aliases":["CVE-2026-125332"],"related":[],"title":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState() rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message and terminate a Node.js process when the application does not catch the exception. The affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http; forge.tls servers are not affected, and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.","summary":null,"severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":[],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":null,"updated_at":"2026-11-10T19:39:26+00:00","category":null,"confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-125332':19A,22A '-2026':18A,21A '1.4.3':41C,140C 'accept':45C 'affect':110C,124C 'algorithm':66C 'also':2A,24C 'alter':85C 'applic':103C 'attack':83C 'byte':90C 'call':3A,25C 'catch':106C 'client':44C,57C,111C 'compress':48C,65C,89C 'confidenti':130C 'connection.process':74C 'cve':17A,20A 'direct':114C 'error':70C 'except':108C 'finish':94C 'fix':137C 'forg':1A,6A,23C,28C 'forge.http':119C 'forge.tls':43C,115C,120C 'forge.tls.wrapsocket':117C 'handl':59C 'impact':133C 'implement':10A,32C 'includ':113C 'integr':132C 'issu':127C,135C 'javascript':16A,38C 'later':58C 'layer':13A,35C 'malici':76C 'messag':95C 'method':49C 'nativ':9A,31C 'node':5A,27C 'node-forg':4A,26C 'node.js':99C 'offer':54C 'on-path':80C 'path':82C,112C 'prior':39C 'process':100C 'propag':72C 'reject':62C 'secur':14A,36C 'server':77C,93C,121C 'serverhello':47C,88C 'serverhellodon':60C 'termin':97C 'throw':68C 'tls.createconnectionstate':61C 'transport':12A,34C 'unauthent':87C 'unsupport':64C 'use':116C 'version':139C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium"],"campaign_type":null,"search_a":"'-125332':19A,22A '-2026':18A,21A 'also':2A 'call':3A 'cve':17A,20A 'forg':1A,6A 'implement':10A 'javascript':16A 'layer':13A 'nativ':9A 'node':5A 'node-forg':4A 'secur':14A 'transport':12A","search_b":"","search_c":"'1.4.3':41C,140C 'accept':45C 'affect':110C,124C 'algorithm':66C 'also':24C 'alter':85C 'applic':103C 'attack':83C 'byte':90C 'call':25C 'catch':106C 'client':44C,57C,111C 'compress':48C,65C,89C 'confidenti':130C 'connection.process':74C 'direct':114C 'error':70C 'except':108C 'finish':94C 'fix':137C 'forg':23C,28C 'forge.http':119C 'forge.tls':43C,115C,120C 'forge.tls.wrapsocket':117C 'handl':59C 'impact':133C 'implement':32C 'includ':113C 'integr':132C 'issu':127C,135C 'javascript':38C 'later':58C 'layer':35C 'malici':76C 'messag':95C 'method':49C 'nativ':31C 'node':27C 'node-forg':26C 'node.js':99C 'offer':54C 'on-path':80C 'path':82C,112C 'prior':39C 'process':100C 'propag':72C 'reject':62C 'secur':36C 'server':77C,93C,121C 'serverhello':47C,88C 'serverhellodon':60C 'termin':97C 'throw':68C 'tls.createconnectionstate':61C 'transport':34C 'unauthent':87C 'unsupport':64C 'use':116C 'version':139C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-04T01:10:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125332","severity":null,"published_at":"2026-11-10T19:21:10+00:00","modified_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null}],"documents":[{"id":117496,"url":"https://github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117497,"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":117498,"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T01:10:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}