CVE-2026-119188
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript
- Risk score
- 50/100
- CVSS
- 7.5 v3.1
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after …
- Affected
- See advisory
- Fix
- Upgrade the product to 1.4.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.
Last activity 29 Oct 2026. Patch Forecast updates every hour.