CVE-2026-125334

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.3

Description A forge.tls client can trigger an uncaught TypeError within the connection.process() function when it receives a handshake record while no session is active. This occurs if a record is received before handshake() is called, after the application calls close(), or following a close notify alert. The issue stems from the tls.handleHandshake() function attempting to dereference c.session.md5 before dispatching the message. A malicious server or an on-path attacker can deliver such a record to terminate a Node.js process if the application does not catch the resulting exception. This issue does not impact confidentiality or integrity, and forge.tls servers are not affected.

Recommendations Update Forge to version 1.4.3. As a temporary workaround, catch exceptions thrown by connection.process() and close the socket, or stop passing socket data to process() once the closed callback has been called and until handshake() is called again.