node-forge CVE-2026-119187

Exploitable only against applications that use node-forge's own TLS stack - connections from forge.tls.createConnection(), including forge.tls.wrapSocket() and the forge.http / forge.xhr TLS connections - where received data is passed to process(). No authentication, no valid handshake, and no extension negotiation are required because heartbeat records are dispatched in every state; a single chunk under 20 KB (~2,300 records on Node.js 24) is sufficient. The decisive limiting factor for real-world impact is the host environment and wiring: in Node.js applications using the documented socket 'data' handler the uncaught exception crashes the whole process (dropping all served connections), whereas in browsers the impact is limited to the single attacked connection. The documented workaround is to wrap every connection.process() call in try/catch and, on exception, call connection.close() and destroy the socket; the vendor states the only complete fix is upgrading to 1.4.1.

This is a genuinely credible but bounded denial-of-service issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) is internally consistent with the mechanism described: a remote, unauthenticated peer can send one sub-20 KB chunk of ~2,300+ tiny records over the network with no user interaction and no valid handshake, since heartbeat records are dispatched in every state before handshake negotiation. The impact is confined to availability (C:N/I:N), which matches a call-stack-exhaustion DoS. No EPSS score and no CISA KEV status were supplied, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified in a KEV/active-exploitation sense,' but the vendor GHSA advisory (GHSA-hqq3-7jhf-c5jx) includes a detailed, working proof-of-concept and regression tests, so a public PoC reference exists even though it is distributed as advisory text rather than a packaged weaponized exploit. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a high-severity availability bug that is easy to trigger but not confirmed as actively exploited. The main caveat is reach: the flaw only affects applications that use node-forge's own TLS implementation (forge.tls.createConnection and its wrappers) wired to a socket data handler - most Node.js deployments use native TLS, so the real-world exposed surface is narrower than the 7.5 score alone implies. Signals are consistent; no CVSS-versus-description conflict was found.

A Node.js server uses forge.tls.createConnection() and calls connection.process(data) from a socket 'data' event, as in the documented usage. An attacker who can open a TCP connection sends a single ~40 KB chunk of thousands of 8-byte heartbeat records before any handshake; process() recurses once per record and throws RangeError: Maximum call stack size exceeded. Because the exception is uncaught in the documented wiring, the Node.js process crashes, dropping every connection it serves, and repeated chunks keep it down. A working PoC is published in the vendor advisory.