Vulnerability Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp
FAQ
What is CVE-2026-119188?
CVE-2026-119188 is a vulnerability with a CVSS score of 7.5 (HIGH). Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake...
How severe is CVE-2026-119188?
CVE-2026-119188 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119188?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.