High severity · published Oct 29, 2026
CVE-2026-119187
Forge: Denial of service in TLS record processing via call stack exhaustion
New
7.5
CVSS
–
EPSS
No
On KEV
Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
forge · digitalbazaar
< 1.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119187
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119187
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx
x_refsource_MISC
https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c
x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
More from forge
9.1
CVE-2026-33896
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
8.6
CVE-2025-12816
No description published yet
7.5
CVE-2026-119191
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
CVE-2026-119188
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
7.5
CVE-2026-118782
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count