CVEvulnerability

CVE-2026-119188

7.5 HIGH EPSS 0.41% Published 2026-10-29 Modified 2026-10-30 Official page ↗

Exploitation and prioritisation

EPSS
0.41% chance of exploitation in the next 30 days · in the top 64.5% of all CVEs (2026-11-03)
CISA SSVC: exploitation
none
CISA SSVC: automatable
yes
CISA SSVC: technical impact
partial
EU Vulnerability Database
EUVD-2026-113365

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
npmnode-forge< 1.4.11.4.1GHSA-8hrf-8g6f-7xwp
Status
Undergoing Analysis
Published
2026-10-29
Last modified
2026-10-30
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248, CWE-476

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.

Related

Weakness · CWE (2)

  • CWE-248 Uncaught Exception weakness
  • CWE-476 NULL Pointer Dereference weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message advisory · npm

References