High severity · published Oct 29, 2026
CVE-2026-119188
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
New
7.5
CVSS
–
EPSS
No
On KEV
Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
forge · digitalbazaar
< 1.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119188
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp
x_refsource_MISC
https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e
x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
More from forge
9.1
CVE-2026-33896
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
8.6
CVE-2025-12816
No description published yet
7.5
CVE-2026-119191
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
CVE-2026-119187
Forge: Denial of service in TLS record processing via call stack exhaustion
7.5
CVE-2026-118782
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count