node-forge CVE-2026-119188

The application must use node-forge's TLS implementation via forge.tls.createConnection() (including forge.tls.wrapSocket() and the forge.http / forge.xhr TLS connections) and call connection.process() from a socket 'data' handler without wrapping it in try/catch - the documented usage pattern. Under those conditions no further prerequisites apply: a remote peer with network reachability triggers the crash unauthenticated with ~18 bytes before the handshake, in both server mode (any client that can connect) and client mode (any server the forge client connects to). Limiting factors: it only affects deployments that actually use forge's TLS layer (not consumers of its crypto primitives alone), and the documented workaround - wrapping every process() call in try/catch - neutralizes it since the connection is already failed and closed when the exception is thrown.

This is a genuine, easily-triggered availability issue but not a confidentiality or integrity threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with the advisory: a remote, unauthenticated peer can crash the process with 18 bytes before the handshake, in either server or client mode, against default behavior. The impact is purely availability (A:H, C:N/I:N) - the vuln.today decision label is 'this_week' rather than act_now/emergency, which fits a high-reliability-impact-but-no-data-exposure DoS. No EPSS score and no KEV status were supplied, so there is no evidence of active exploitation; a detailed working PoC (exact byte sequence plus regression tests) is published in the GitHub Security Advisory, so public exploit material does exist. The main nuance limiting real-world risk is scope: only applications that actually use node-forge's TLS layer (forge.tls.createConnection, forge.tls.wrapSocket, forge.http/forge.xhr) and call process() from a socket data handler without try/catch - the documented usage - are affected; consumers that use node-forge only for its crypto primitives are not. Note the input Tags label this 'Information Disclosure', which contradicts the advisory and the CVSS vector (C:N/I:N, A:H); this is a denial-of-service bug, not information disclosure.

An attacker who can reach a Node.js service that terminates TLS with node-forge (server mode) - or a service that opens an outbound forge TLS client connection the attacker controls - sends two tiny records: the start of a fragmented handshake message followed by a record of a different content type (alert, change_cipher_spec, application_data or heartbeat). node-forge fails the connection correctly but then throws an uncaught TypeError from process(), terminating the hosting process and dropping all its connections; the attacker can repeat this on every restart. A complete, working 18-byte PoC and regression tests are published in the GHSA advisory.