CVE-2026-118778 in Forge
Summary
by MITRE • 10/29/2026
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in node-forge, a native implementation of Transport Layer Security written in JavaScript, stems from an incorrect property check during the TLS handshake process. Specifically, prior to version 1.4.1, the library utilized forge.tls.createConnection() and relied on c.session.serverCertificate for RSA key exchange operations. The core technical flaw lies in the logic used by the node-forge TLS client to determine if a server certificate was present. Instead of verifying the correct property that indicates the existence or validity of the certificate object, the implementation checked an incorrect attribute. This logical error means that even when no Certificate message is received from the server, the application proceeds under the false assumption that a valid certificate context exists.
From an operational perspective, this defect allows a malicious TLS server or an on-path attacker to exploit the misconfiguration by omitting the Certificate message during the handshake negotiation. When such a scenario occurs, the client code attempts to dereference the absent certificate object. Because the property check failed to detect the absence of the certificate, the subsequent access results in an uncaught exception within the JavaScript runtime environment. This typically leads to the abrupt termination of the connection or, depending on how the host application handles exceptions, potentially crashes the entire process hosting the node-forge instance.
This issue is classified as a Denial of Service vulnerability due to its ability to cause service disruption through resource exhaustion via crash conditions. In terms of industry standards, this aligns with CWE-20: Improper Input Validation, specifically regarding the failure to validate the presence and integrity of expected security artifacts during protocol negotiation. Furthermore, it relates to CWE-476: NULL Pointer Dereference, as the code attempts to access properties or methods on a null or undefined certificate object resulting from the missing handshake message. From an ATT&CK perspective, this vulnerability can be leveraged in the context of T1059: Command and Scripting Interpreter if it leads to process crashes that disrupt security monitoring tools, or more broadly as part of reconnaissance activities where attackers probe for implementation weaknesses before launching further attacks.
The mitigation strategy is straightforward and involves upgrading node-forge to version 1.4.1 or later, which corrects the property check logic to accurately detect missing certificates. For environments unable to upgrade immediately, implementing a wrapper around forge.tls.createConnection() that validates session states and handles potential null references explicitly can provide temporary protection. Additionally, ensuring that host applications implement robust exception handling for TLS-related errors can prevent uncaught exceptions from terminating critical processes, thereby maintaining service availability even if the underlying library exhibits this flaw.