Zero Radar
← feed
HighVulnerabilityCVE-2026-119187updated 30 Oct 2026, 23:02 UTC

node-forge TLS: remote peer can crash Node.js process via many small records

A remote computer that connects to your app can send one burst of many tiny messages and make the program crash. The crash stops the service until it restarts.

Fixed in node-forge 1.4.1 · out Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesnode-forge 1.4.1 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Malicious peerConnects without logging in
  2. 2Burst of recordsThousands of tiny TLS records in one chunk
  3. 3node-forge recursionOne stack frame added per record
  4. 4Stack overflowRangeError thrown, not caught
  5. 5Process crashesNode.js process terminates
  6. ResultService goes down until restarted

What happened

In node-forge's TLS connection code (forge.tls.createConnection), each received TLS record is handled through recursive calls, one stack frame per record. Sending thousands of small records in one chunk, such as heartbeat records accepted before the handshake, exhausts the JavaScript call stack and throws an uncaught RangeError.

Why it is dangerous: Any service using node-forge TLS sockets can be taken offline by an unauthenticated peer, with no login or valid handshake needed. Both servers accepting clients and clients connecting to hostile servers are at risk.

Are you affected?

You are affected if you use node-forge 1.4.0 or earlier to create TLS connections with forge.tls.createConnection() and feed socket data into connection.process().

Package / productAffected versionsFixed in
node-forge · npm<= 1.4.01.4.1

What to do

  1. Update node-forge to version 1.4.1 or later
  2. Check whether your project uses forge.tls.createConnection() so you know which services are exposed
  3. If you cannot update yet, wrap every connection.process() call in try/catch and close the connection and socket on error

Timeline

  1. 29 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 20:21 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:02 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 23:02 UTC
    Fixed version published: node-forge 1.4.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119187 · GHSA-hqq3-7jhf-c5jx
CVSS
7.5 / 10
Disclosed
29 Oct 2026, 20:17 UTC
On Zero Radar
29 Oct 2026, 20:21 UTC (4 min after disclosure)
Last change
30 Oct 2026, 23:02 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

node-forge TLS: remote peer can crash Node.js process via many small records · Zero Radar