CVEvulnerability

CVE-2026-118778

5.9 MEDIUM EPSS 0.20% Published 2026-10-29 Modified 2026-11-03 Official page ↗

Exploitation and prioritisation

EPSS
0.20% chance of exploitation in the next 30 days · in the top 89.6% of all CVEs (2026-11-03)
CISA SSVC: exploitation
poc
CISA SSVC: automatable
no
CISA SSVC: technical impact
partial
EU Vulnerability Database
EUVD-2026-113336

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
npmnode-forge< 1.4.11.4.1GHSA-525v-9gp9-w22h
Status
Undergoing Analysis
Published
2026-10-29
Last modified
2026-11-03
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-476

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1.

Related

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-525v-9gp9-w22h Forge: TLS client crash when the server sends no certificate advisory · npm

References