AZL-113609: CVE-2026-125332 affecting package python-tensorboard 2.16.2-6
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compressionmethod that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState() rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message and terminate a Node.js process when the application does not catch the exception. The affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http; forge.tls servers are not affected, and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using forge.tls as a TLS client are affected, including direct forge.tls use, forge.tls.wrapSocket, and forge.http. forge.tls servers are not affected.
What does an attacker need to exploit the issue?
An attacker must operate a malicious server or be able to modify the unauthenticated ServerHello compression byte on the network before the server Finished message. Exploitation can terminate a Node.js process if the application does not catch the propagated exception.
What is the impact of successful exploitation?
The issue causes a denial of service through process termination. The provided information states that it has no confidentiality or integrity impact.
What should be done to remediate the issue?
Update Forge/node-forge to version 1.4.3, which fixes the issue. If an immediate update is not possible, catching the exception propagated from connection.process() can prevent the described process termination.