Zero Radar
← feed
HighVulnerabilityCVE-2026-119188updated 30 Oct 2026, 23:02 UTC

node-forge TLS library can crash Node.js processes via malformed records

A remote computer can send a few specially crafted bytes to a Node.js program using this TLS library, which makes the whole program crash. No login is needed to trigger it.

Fixed in node-forge 1.4.1 · out Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesnode-forge 1.4.1 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote peerSends a crafted, unauthenticated TLS record
  2. 2Split handshakeHandshake fragment followed by a different record type
  3. 3process() callnode-forge keeps processing after the error
  4. 4Uncaught TypeErrorNull connection record is accessed
  5. ResultNode.js process crashes

What happened

In node-forge's TLS implementation (forge.tls.createConnection), receiving a record of a different content type while a handshake message is split across records causes an uncaught TypeError from process(), which terminates the hosting process.

Why it is dangerous: Any Node.js service that accepts TLS connections through node-forge can be taken down by an unauthenticated remote peer, causing denial of service.

Are you affected?

You are affected if you use node-forge version 1.4.0 or earlier and call forge.tls.createConnection() with socket data passed to connection.process().

Package / productAffected versionsFixed in
node-forge · npm<= 1.4.01.4.1

What to do

  1. Update node-forge to version 1.4.1 or later
  2. If you cannot update yet, wrap every connection.process() call in try/catch and destroy the socket on error
  3. Check your dependency tree for node-forge versions 1.4.0 or earlier

Timeline

  1. 29 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 20:21 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:02 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 23:02 UTC
    Fixed version published: node-forge 1.4.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119188 · GHSA-8hrf-8g6f-7xwp
CVSS
7.5 / 10
Disclosed
29 Oct 2026, 20:17 UTC
On Zero Radar
29 Oct 2026, 20:21 UTC (4 min after disclosure)
Last change
30 Oct 2026, 23:02 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

node-forge TLS library can crash Node.js processes via malformed records · Zero Radar