PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-119188 digitalbazaar CVE debrief

A connection created with `forge.tls.createConnection()` throws an uncaught `TypeError` from `process()` when it receives a record of another content type while waiting for the rest of a handshake message that was split across records. A peer can trigger this with 18 bytes before the handshake, without authentication, which terminates Node.js processes that use the documented socket wiring. Fixed in node-forge 1.4.1.

Vendor
digitalbazaar
Product
node-forge
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-30
Original CVE updated
2026-10-30
Advisory published
2026-10-30
Advisory updated
2026-10-30

Who should care

Defenders responsible for Node.js processes using the documented socket wiring with `forge.tls.createConnection()` should assess exposure and prioritize upgrading to node-forge 1.4.1 if vulnerable.

Why it matters

Defenders should prioritize verifying exposure of Node.js processes using the documented socket wiring with `forge.tls.createConnection()` and upgrading to node-forge 1.4.1 if vulnerable, as denial of service attacks may be possible without authentication.

  • Denial of service attacks may be possible without authentication
  • Node.js processes using the documented socket wiring may be terminated

Technical summary

The `_readRecord()` function in `lib/tls.js` handles a record that arrives while a handshake message split across records is incomplete. If the record has any other content type, forge correctly reports 'Invalid fragmented record.' through `c.error()` with a fatal `unexpected_message` alert. However, the code then continues with `c.record.ready = true` and throws `TypeError: Cannot set properties of null (setting 'ready')` out of `process()`.

Defensive priority

Defenders should prioritize verifying exposure of Node.js processes using the documented socket wiring with `forge.tls.createConnection()` and upgrading to node-forge 1.4.1 if vulnerable.

Recommended defensive actions

  • Verify Node.js processes using `forge.tls.createConnection()` for exposure
  • Upgrade to node-forge 1.4.1 if vulnerable
  • Monitor for potential denial of service attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including a description of the issue, affected versions, and fixed versions. Defenders should verify Node.js processes using `forge.tls.createConnection()` for exposure and consider upgrading to node-forge 1.4.1 if vulnerable. Evidence is limited to public CVE and source item details, with no additional information available for verification.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-119188 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-119188

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-119188 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-119188

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.