CVE-2026-119187

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1

Description Forge, a native JavaScript implementation of Transport Layer Security, handles received TLS records recursively when using the forge.tls.createConnection() function and the process() function for TLS record processing. This behavior consumes one JavaScript stack frame per record within a single input chunk. A remote peer can trigger a denial of service by sending thousands of small records simultaneously, which exhausts the call stack and leads to an uncaught exception.

Recommendations Update Forge to version 1.4.1.