CVE-2026-119188: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

October 30, 2026

A connection created with forge.tls.createConnection() throws an uncaught TypeError from process() when it receives a record of another content type while waiting for the rest of a handshake message that was split across records. A peer can trigger this with 18 bytes before the handshake, without authentication, which terminates Node.js processes that use the documented socket wiring. Fixed in node-forge 1.4.1.

References

github.com/advisories/GHSA-8hrf-8g6f-7xwp
github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e
github.com/digitalbazaar/forge/releases/tag/v1.4.1
github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp
nvd.nist.gov/vuln/detail/CVE-2026-119188

Code Behaviors & Features

Detect and mitigate CVE-2026-119188 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →