UBUNTU-CVE-2026-125332: Medium severity ubuntu/node-node-forge vulnerability
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compressionmethod that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState() rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message and terminate a Node.js process when the application does not catch the exception. The affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http; forge.tls servers are not affected, and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using node-forge as a TLS client through direct forge.tls use, forge.tls.wrapSocket, or forge.http are affected before version 1.4.3. forge.tls server use is not affected.
What does an attacker need to exploit it?
An attacker must control a malicious TLS server or be able to modify the unauthenticated ServerHello compression byte on the network before the server Finished message. Exploitation causes an uncaught Error that can terminate the Node.js process.
Is there a confidentiality or integrity impact?
No. The described impact is denial of service through process termination; the issue does not have a confidentiality or integrity impact.
What should be done to remediate the issue?
Update node-forge to version 1.4.3 or later. If updating cannot happen immediately, ensure the application catches the exception from the affected TLS client processing path to prevent process termination.