Bug 2563659 (CVE-2026-119187)

Summary:	CVE-2026-119187 node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abarbaro, alizardo, amctagga, aoconnor, bbrownin, bniver, cdrage, csuconic, dbruscin, dhanak, doconnor, drosa, dschmidt, dsimansk, eshamard, flucifre, fmariani, gmalinko, gmeno, groman, gtully, janstey, jchui, jhe, jlanda, jsherman, jvasik, jwon, kaycoth, kingland, kshier, ktsao, kvanderr, lchilton, mbenjamin, mcarlett, mhackett, mnovotny, nboldt, oaljalju, pdelbell, pjindal, psrna, rblanco, rbobbitt, rgemmell, rgodfrey, rhel-process-autobot, rstepani, rushinde, sausingh, sfeifer, simaishi, sostapov, stcannon, tbish, tcunning, tlavocat, vereddy, watson-tool-maintainers, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in node-forge. The Transport Layer Security (TLS) implementation processes incoming records through recursive function calls instead of an iterative loop. An unauthenticated remote attacker can exploit this flaw by sending a network payload containing a large number of small TLS records. This triggers excessive recursion that exhausts the call stack, causing an unhandled crash and leading to a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 19:36:56 UTC

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.