7.5 High

CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion

Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
forge 1.4	earliest → < 1.4.1	1.4.1

References

github.com github.com
github.com github.com
github.com github.com

Timeline

Published October 29, 2026
Last modified November 4, 2026

The 25 CVEs of forge →

CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer 7.5 High CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.4 High CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 5.9 Medium CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.5 High

Track this CVE