AZL-113603: CVE-2026-125334 affecting package python-tensorboard 2.16.2-6
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a closenotify alert, after the application calls close(), or before handshake() is called. The handler dereferences c.session.md5 before dispatching the message, causing a TypeError to propagate from connection.process(). A malicious server or on-path attacker can deliver the record, including after a reset when the connection uses no encryption, and terminate a Node.js process if the application does not catch the exception. forge.tls servers are not affected, and there is no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
What systems are exposed to denial of service from this issue?
Applications using forge.tls as a client are exposed if an exception from connection.process() is not caught. forge.tls servers are not affected.
What does an attacker need to exploit the issue?
A malicious TLS server or an on-path attacker must be able to deliver a handshake record while the client connection has no session. This can occur after a close_notify alert, after the application calls close(), before handshake() is called, or after a reset when the connection uses no encryption.
What is the impact of successful exploitation?
The malformed connection state causes a TypeError when the handler dereferences c.session.md5, and the exception can terminate the Node.js process. The issue does not affect confidentiality or integrity.
What can be done if an update cannot be applied immediately?
Ensure the application catches exceptions propagated from connection.process() so that an attacker-triggered TypeError does not terminate the Node.js process.
Which version fixes the issue?
The issue is fixed in Forge version 1.4.3.