CVE-2026-119187

The record

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.

Affected packages

Related vulnerabilities

• CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. CWE-674
• CVE-2026-61847 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-674
• CVE-2026-61846 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-674
• CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2… CWE-674
• CVE-2026-119542 A flaw was found in the Ickle query parser in Infinispan. CWE-674
• CVE-2026-119591 SQLite before 3.54.0 contains a stack exhaustion vulnerability in… CWE-674
• CVE-2026-119376 SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to… CWE-674
• CVE-2026-119371 SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to… CWE-674