CVE-2026-125332: Forge: TLS client crash on an unsupported ServerHello compression method
A forge.tls client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes connection.process() throw an uncaught Error when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3.
References
- github.com/advisories/GHSA-w4xr-hqv8-ch44
- github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef
- github.com/digitalbazaar/forge/pull/1169
- github.com/digitalbazaar/forge/releases/tag/v1.4.3
- github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44
- nvd.nist.gov/vuln/detail/CVE-2026-125332
Code Behaviors & Features
Detect and mitigate CVE-2026-125332 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →