AZL-112478: CVE-2026-119188 affecting package python-tensorboard 2.16.2-6

Q: Which deployments are exposed to this issue?

Deployments are exposed if they use node-forge TLS connections through forge.tls.createConnection() and can receive TLS traffic from a remote peer. The issue applies to affected node-forge implementations prior to version 1.4.1.

Q: What does an attacker need to do to trigger the failure?

A remote peer must send fragmented TLS handshake data and interleave a TLS record of another content type while the handshake is being processed. This can cause an uncaught TypeError in process().

Q: What is the remediation?

Update the affected node-forge implementation to version 1.4.1 or later. Version 1.4.1 contains the fix.

Q: How can I determine whether my environment may be affected?

Check whether the application includes a node-forge version earlier than 1.4.1 and uses forge.tls.createConnection(). The reported software entry is azure-linux/python-tensorboard version 2.16.2-6.

Published Oct 29, 2026

Updated

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1.

Affected Software

1 affected component

azure-linux/python-tensorboard<=2.16.2-6

Event History

Oct 29, 2026

Advisory Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119188

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments are exposed if they use node-forge TLS connections through forge.tls.createConnection() and can receive TLS traffic from a remote peer. The issue applies to affected node-forge implementations prior to version 1.4.1.

What does an attacker need to do to trigger the failure?

A remote peer must send fragmented TLS handshake data and interleave a TLS record of another content type while the handshake is being processed. This can cause an uncaught TypeError in process().

What is the remediation?

Update the affected node-forge implementation to version 1.4.1 or later. Version 1.4.1 contains the fix.

How can I determine whether my environment may be affected?

Check whether the application includes a node-forge version earlier than 1.4.1 and uses forge.tls.createConnection(). The reported software entry is azure-linux/python-tensorboard version 2.16.2-6.

AZL-112478: CVE-2026-119188 affecting package python-tensorboard 2.16.2-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the failure?

What is the remediation?

How can I determine whether my environment may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the failure?

What is the remediation?

How can I determine whether my environment may be affected?