CVE-2026-118778

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1

Description The TLS client in this native JavaScript implementation of Transport Layer Security incorrectly checks the property used to determine if a server certificate is missing. When using forge.tls.createConnection(), c.session.serverCertificate, and RSA key exchange, a malicious TLS server or on-path peer can omit the Certificate message. This leads to the dereferencing of the absent certificate, resulting in an uncaught exception that terminates the connection or the process.

Recommendations Update to version 1.4.1.