CVE-2026-125332

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.3

Description A forge.tls client accepts a compression method in the ServerHello that it did not offer. When the client handles ServerHelloDone, the tls.createConnectionState() function rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message to terminate a Node.js process if the application does not catch the exception. Affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http. This issue does not impact confidentiality or integrity, and forge.tls servers are not affected.

Recommendations Update Forge to version 1.4.3. As a temporary workaround, catch exceptions thrown by connection.process() and close the socket.