GHSA-HQQ3-7JHF-C5JX Forge: Denial of service in TLS record processing via call stack exhaustion

Summary Connections created with forge.tls.createConnection processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and process throws RangeError: Maximum...

Forge: Denial of service in TLS record processing via call stack exhaustion

Summary Connections created with forge.tls.createConnection processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and process throws RangeError: Maximum...

npm: Forge: Denial of service in TLS record processing via call stack exhaustion

npm: Forge: Denial of service in TLS record processing via call stack exhaustion vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

EUVD-2026-113364

Forge: Denial of service in TLS record processing via call stack exhaustion...

CVE-2026-119187

A flaw was found in node-forge. The Transport Layer Security TLS implementation processes incoming records through recursive function calls instead of an iterative loop. An unauthenticated remote attacker can exploit this flaw by sending a network payload containing a large number of small TLS...

Linux Distros Unpatched Vulnerability : CVE-2026-119187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used...

AZL-112472 CVE-2026-119187 affecting package python-tensorboard 2.16.2-6

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

UBUNTU-CVE-2026-119187

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187

The Forge (also known as node-forge ) JavaScript TLS implementation is vulnerable to a Denial of Service (DoS) via call stack exhaustion. In versions prior to 1.4.1 , the forge.tls.createConnection() function processes received TLS records recursively, consuming one JavaScript stack frame per rec...

CVE-2026-119187

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

PT-2026-132807

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1 Description Forge, a native JavaScript implementation of Transport Layer Security, handles received TLS records recursively when using the forge.tls.createConnection function and the process function for TLS recor...

CVE-2026-119187: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection, TLS record processing, process to process the relevant input or security decision. node-forge processed received TLS...

Uncontrolled Recursion

Overview msgpack5 is an A msgpack v5 implementation for node.js and the browser, with extension points Affected versions of this package are vulnerable to Uncontrolled Recursion via the transform method in lib/streams.js, where the decoder recursively calls itself when the chunk buffer still...

GHSA-5X5G-H9X8-2FH9 msgpack5: Many buffered values can exhaust the streaming decoder stack

Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream. Patches The streaming decoder now drains concatenated...

AZL-106851 CVE-2026-107300 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...

CVE-2026-107300

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...