CVEvulnerability

CVE-2026-119187

7.5 HIGH EPSS 0.41% Published 2026-10-29 Modified 2026-10-31 Official page ↗

Exploitation and prioritisation

EPSS
0.41% chance of exploitation in the next 30 days · in the top 64.2% of all CVEs (2026-11-03)
EU Vulnerability Database
EUVD-2026-113364

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
npmnode-forge< 1.4.11.4.1GHSA-hqq3-7jhf-c5jx
Status
Analyzed
Published
2026-10-29
Last modified
2026-10-31
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.

Affected configurations

• digitalbazaar forge (< 1.4.1)

Related

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-hqq3-7jhf-c5jx Forge: Denial of service in TLS record processing via call stack exhaustion advisory · npm

References