CVE-2026-125332

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compressionmethod that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState rejects the unsupported...

EUVD-2026-122792

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compressionmethod that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState rejects the unsupported...

PT-2026-144407

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.3 Description A forge.tls client accepts a compression method in the ServerHello that it did not offer. When the client handles ServerHelloDone, the tls.createConnectionState function rejects the unsupported...

CVE-2026-125332: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compressionmethod that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState rejects the unsupported...

PT-2026-144409

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.3 Description A forge.tls client can trigger an uncaught TypeError within the connection.process function when it receives a handshake record while no session is active. This occurs if a record is received before...