Read the docs
TI-2026-82736 Aliases CVE-2026-119188GHSA-8hrf-8g6f-7xwp

Denial of service in Forge TLS handshake processing

Priority LOW 39CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 13 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

Forge (node-forge) before 1.4.1 keeps processing TLS records after a record of another content type interrupts a fragmented handshake message, which causes an uncaught TypeError in process() (CWE-248). A remote peer that needs no privileges or user interaction can send such records to crash the connection or the hosting process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00411 35th percentileScored 2026-11-07
Fix Partial forge (digitalbazaar): 1.4.1node-forge (npm): 1.4.1Red Hat: 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
digitalbazaarforgebefore 1.4.11.4.1Patch availableCNA
—node-forge (npm)before 1.4.11.4.1Patch availableGHSA-8hrf-8g6f-7xwp
  • forge Vendordigitalbazaar Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA
  • node-forge (npm) Vendor— Affected before 1.4.1 Fixed in 1.4.1 Patch available GHSA-8hrf-8g6f-7xwp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:*——digitalbazaar
  • cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* Versions — — ·digitalbazaar

Remediation

Upgrade the digitalbazaar forge and npm node-forge packages to version 1.4.1. Red Hat lists no available plan for Node HealthCheck Operator, OpenShift Pipelines, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2 and other products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA forge (digitalbazaar) Fixed in 1.4.1
  • Fix · GHSA-8hrf-8g6f-7xwp node-forge (npm) Fixed in 1.4.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Node HealthCheck OperatorAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Not affected: 8 products
  • OpenShift Service Mesh 3
  • Red Hat AMQ Broker 7
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat Quay 3
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119188
  2. 2026-10-30 Affected versions changed · Red Hat
  3. 2026-10-30 CVSS score added · Red Hat
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-10-30 Priority changed: MEDIUM → LOW
  6. 2026-10-30 Alias added: GHSA-8hrf-8g6f-7xwp
  7. 2026-10-30 Fix available: npm/[email protected] · GHSA-8hrf-8g6f-7xwp
  8. 2026-10-30 CVSS score added · GHSA-8hrf-8g6f-7xwp
  9. 2026-10-30 Weakness changed · GHSA-8hrf-8g6f-7xwp
  10. 2026-10-30 5 new references · GHSA-8hrf-8g6f-7xwp
  11. 2026-10-31 Affected versions changed · Red Hat
  12. 2026-11-02 Affected versions changed · Red Hat
  13. 2026-11-03 Affected versions changed · Red Hat
  14. 2026-11-05 Affected versions changed · Red Hat
  15. 2026-11-05 Affected versions changed · Red Hat
  16. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-58601 node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding CVSS 4.0HIGH 8.7
  • TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
  • TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
  • TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-82733 Forge accepts zero iteration count, enabling PKCS#12 integrity bypass CVSS 3.1HIGH 7.5
  • TI-2026-82730 Regular expression denial of service in Forge PEM decoding CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences