{"id":"CVE-2026-125334","kind":"vulnerability","aliases":["CVE-2026-125334"],"related":[],"title":"node-forge: crafted TLS handshake record crashes Node.js client process","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a close_notify alert, after the application calls close(), or before handshake() is called. The handler dereferences c.session.md5 before dispatching the message, causing a TypeError to propagate from connection.process(). A malicious server or on-path attacker can deliver the record, including after a reset when the connection uses no encryption, and terminate a Node.js process if the application does not catch the exception. forge.tls servers are not affected, and there is no confidentiality or integrity impact. This issue is fixed in version 1.4.3.","summary":"A forge.tls client that receives a handshake record while it has no session dereferences a null session and throws a TypeError. If the application does not catch that exception, a malicious server or on-path attacker can terminate the Node.js process.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node-forge","node.js","package","tls"],"not_affected_if":["exceptions-caught","forge-tls-server-only"],"how_to_check":"- Check the installed version with `npm ls node-forge`\n- Look for code that uses `forge.tls` in client mode and does not wrap `connection.process()` in a try/catch","fix":"- `node-forge` `1.4.3`","status":"open","published_at":"2026-11-10T19:21:11+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","triaged_at":"2026-11-10T19:59:54+00:00","updated_at":"2026-11-10T19:59:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T19:59:54Z","model":"claude-haiku-5-5","output":{"fix":"- `node-forge` `1.4.3`","reach":"network","title":"node-forge: crafted TLS handshake record crashes Node.js client process","impact":"low","summary":"A forge.tls client that receives a handshake record while it has no session dereferences a null session and throws a TypeError. If the application does not catch that exception, a malicious server or on-path attacker can terminate the Node.js process.","audience":"developers","category":"package","nicknames":[],"who_cares":["node-forge","node.js","javascript","tls"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Node.js process terminates when an uncaught exception is thrown","analyst_note":"","how_to_check":"- Check the installed version with `npm ls node-forge`\n- Look for code that uses `forge.tls` in client mode and does not wrap `connection.process()` in a try/catch","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["forge-tls-server-only","exceptions-caught"],"who_is_affected":"Applications that use node-forge's forge.tls client (not forge.tls servers, which the advisory says are unaffected) and do not catch exceptions thrown from connection.process(). A malicious server or on-path attacker can trigger the crash, including after a reset on an unencrypted connection. Applications that do not use forge.tls client code can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4735,"output_tokens":508,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125334':14A,17A '-2026':13A,16A '1.4.3':85C,188C 'affect':173C 'alert':107C 'also':68C 'applic':48B,110C,163C 'attack':61B,141C 'c.session':121C 'call':69C,111C,117C 'catch':51B,166C 'caus':127C 'client':10A,27B,88C 'close':105C,112C 'confidenti':178C 'connect':98C,152C 'connection.process':133C 'craft':4A 'crash':8A 'cve':12A,15A 'deliv':143C 'derefer':38B,120C 'dispatch':124C 'encrypt':155C 'except':53B,168C 'fix':185C 'forg':3A,21B,67C,72C 'forge.tls':26B,87C,169C 'handler':119C 'handshak':6A,31B,92C,115C 'impact':181C 'implement':76C 'includ':102C,146C 'integr':180C 'issu':183C 'javascript':18B,82C 'layer':79C 'malici':55B,135C 'md5':122C 'messag':126C 'nativ':75C 'node':2A,20B,71C 'node-forg':1A,19B,70C 'node.js':9A,22B,65B,159C 'notifi':106C 'null':40B 'on-path':58B,138C 'packag':23B 'pass':90C 'path':60B,140C 'prior':83C 'process':11A,66B,160C 'propag':131C 'receiv':29B 'record':7A,32B,93C,145C 'reset':149C 'secur':80C 'server':56B,136C,170C 'session':37B,41B,101C 'termin':63B,157C 'throw':43B 'tls':5A,24B 'tls.handlehandshake':95C 'transport':78C 'typeerror':45B,129C 'use':153C 'version':187C","nicknames":[],"mitigations":[],"who_affected":"Applications that use node-forge's forge.tls client (not forge.tls servers, which the advisory says are unaffected) and do not catch exceptions thrown from connection.process(). A malicious server or on-path attacker can trigger the crash, including after a reset on an unencrypted connection. Applications that do not use forge.tls client code can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["javascript","medium","nodeforge","nodejs","package","tls"],"campaign_type":null,"search_a":"'-125334':14A,17A '-2026':13A,16A 'client':10A 'craft':4A 'crash':8A 'cve':12A,15A 'forg':3A 'handshak':6A 'node':2A 'node-forg':1A 'node.js':9A 'process':11A 'record':7A 'tls':5A","search_b":"'applic':48B 'attack':61B 'catch':51B 'client':27B 'derefer':38B 'except':53B 'forg':21B 'forge.tls':26B 'handshak':31B 'javascript':18B 'malici':55B 'node':20B 'node-forg':19B 'node.js':22B,65B 'null':40B 'on-path':58B 'packag':23B 'path':60B 'process':66B 'receiv':29B 'record':32B 'server':56B 'session':37B,41B 'termin':63B 'throw':43B 'tls':24B 'typeerror':45B","search_c":"'1.4.3':85C,188C 'affect':173C 'alert':107C 'also':68C 'applic':110C,163C 'attack':141C 'c.session':121C 'call':69C,111C,117C 'catch':166C 'caus':127C 'client':88C 'close':105C,112C 'confidenti':178C 'connect':98C,152C 'connection.process':133C 'deliv':143C 'derefer':120C 'dispatch':124C 'encrypt':155C 'except':168C 'fix':185C 'forg':67C,72C 'forge.tls':87C,169C 'handler':119C 'handshak':92C,115C 'impact':181C 'implement':76C 'includ':102C,146C 'integr':180C 'issu':183C 'javascript':82C 'layer':79C 'malici':135C 'md5':122C 'messag':126C 'nativ':75C 'node':71C 'node-forg':70C 'node.js':159C 'notifi':106C 'on-path':138C 'pass':90C 'path':140C 'prior':83C 'process':160C 'propag':131C 'record':93C,145C 'reset':149C 'secur':80C 'server':136C,170C 'session':101C 'termin':157C 'tls.handlehandshake':95C 'transport':78C 'typeerror':129C 'use':153C 'version':187C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-04T01:08:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125334","severity":null,"published_at":"2026-11-10T19:21:11+00:00","modified_at":"2026-11-10T19:21:11+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","fetched_at":"2026-11-10T19:25:15+00:00","note":null}],"documents":[{"id":117502,"url":"https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117497,"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":117504,"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T01:08:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}