Vulnerability Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Digitalbazaar | Forge | < 1.4.1 |
Related Weaknesses (CWE)
References
- https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9fPatch
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.1Release Notes
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jxExploitMitigationVendor Advisory
FAQ
What is CVE-2026-119187?
CVE-2026-119187 is a vulnerability with a CVSS score of 7.5 (HIGH). Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processin...
How severe is CVE-2026-119187?
CVE-2026-119187 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119187?
Check the references section above for vendor advisories and patch information. Affected products include: Digitalbazaar Forge.