Bug 2563659 (CVE-2026-119187) - CVE-2026-119187 node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing
Summary: CVE-2026-119187 node-forge: node-forge: Denial of Service via call stack exha...
Keywords:
Status: NEW
Alias: CVE-2026-119187
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-29 19:36 UTC by OSIDB Bzimport
Modified: 2026-11-03 08:30 UTC (History)
62 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-29 19:36:56 UTC 
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.
Note You need to log in before you can comment on or make changes to this bug.