Vulnerability · Published Oct 29, 2026 · Assigned by GitHub_M

CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustion

High 7.5

In plain English

A high-severity security flaw in forge from digitalbazaar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	node-node-forge	no fix listed	UBUNTU-CVE-2026-119187
npm	node-forge	1.4.1	GHSA-hqq3-7jhf-c5jx

Affected products (as reported)

Vendor	Product	Versions
digitalbazaar	forge	< 1.4.1

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/tag/v1.4.1 x_refsource_MISC