CVE-2026-119187

The Forge (also known as node-forge ) JavaScript TLS implementation is vulnerable to a Denial of Service (DoS) via call stack exhaustion. In versions prior to 1.4.1 , the forge.tls.createConnection() function processes received TLS records recursively, consuming one JavaScript stack frame per rec...