{"affected":[{"product":"forge","source":"CNA: GitHub_M","vendor":"digitalbazaar","versions":[{"status":"affected","version":"< 1.4.3"}]},{"ecosystem":"npm","packageName":"node-forge","product":"node-forge","source":"GitHub GHSA-j8rw-jp99-435v","vendor":"","versions":[{"status":"affected","version":"<= 1.4.2","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"node-forge","product":"node-forge","source":"OSV GHSA-j8rw-jp99-435v","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"1.4.3"}],"lessThan":"1.4.3","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-125334","cwes":["CWE-476"],"description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a close_notify alert, after the application calls close(), or before handshake() is called. The handler dereferences c.session.md5 before dispatching the message, causing a TypeError to propagate from connection.process(). A malicious server or on-path attacker can deliver the record, including after a reset when the connection uses no encryption, and terminate a Node.js process if the application does not catch the exception. forge.tls servers are not affected, and there is no confidentiality or integrity impact. This issue is fixed in version 1.4.3.","epss":{"date":"2026-11-13","percentile":0.20877,"score":0.00281},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"}],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":5.9,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794625269437,"publishedAt":1794336595508,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-j8rw-jp99-435v"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-j8rw-jp99-435v"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-j8rw-jp99-435v","text":"node-forge (npm): GitHub reports patched versions 1.4.3. Check the advisory for the affected release branch.","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"},{"kind":"fix","source":"OSV GHSA-j8rw-jp99-435v","text":"node-forge (npm): OSV reports a fixed version 1.4.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-j8rw-jp99-435v"}],"revision":"ac07fdc54ee58bbd9e8e25259e8feded36f586a01751a3201709e910d2c0a9b9","sources":[{"modifiedAt":1794625269437,"name":"CNA: GitHub_M","retrievedAt":1794629305551,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125334"},{"modifiedAt":1794347194010,"name":"NVD","retrievedAt":1794356904563,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125334"},{"modifiedAt":1794336561000,"name":"GitHub Security Advisories","retrievedAt":1794527709490,"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"},{"modifiedAt":1794346204008,"name":"OSV / GitHub Security Advisories","retrievedAt":1794629306138,"url":"https://osv.dev/vulnerability/GHSA-j8rw-jp99-435v"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794629328676,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-125334"}],"ssvc":{"assessedAt":1794625246590,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Forge: TLS client crash on a handshake record received without a session","updatedAt":1794629328676}