Bug 2563661 (CVE-2026-119188)

Summary:	CVE-2026-119188 node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abarbaro, alizardo, amctagga, aoconnor, bbrownin, bniver, cdrage, csuconic, dbruscin, dhanak, doconnor, drosa, dschmidt, dsimansk, eshamard, flucifre, fmariani, gmalinko, gmeno, groman, gtully, janstey, jchui, jhe, jlanda, jsherman, jvasik, jwon, kaycoth, kingland, kshier, ktsao, kvanderr, lchilton, mbenjamin, mcarlett, mhackett, mnovotny, nboldt, oaljalju, pdelbell, pjindal, psrna, rblanco, rbobbitt, rgemmell, rgodfrey, rhel-process-autobot, rstepani, rushinde, sausingh, sfeifer, simaishi, sostapov, stcannon, tbish, tcunning, tlavocat, vereddy, watson-tool-maintainers, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in node-forge. A remote attacker can trigger a Denial of Service (DoS) by sending an unexpected Transport Layer Security (TLS) record during a fragmented handshake sequence. Because the library fails to cleanly halt processing after closing the invalid connection, it throws an uncaught exception. This causes the host application process to terminate abruptly, dropping all active network connections.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 19:41:05 UTC

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.