UBUNTU-CVE-2026-125334: Medium severity ubuntu/node-node-forge vulnerability
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a closenotify alert, after the application calls close(), or before handshake() is called. The handler dereferences c.session.md5 before dispatching the message, causing a TypeError to propagate from connection.process(). A malicious server or on-path attacker can deliver the record, including after a reset when the connection uses no encryption, and terminate a Node.js process if the application does not catch the exception. forge.tls servers are not affected, and there is no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only applications using forge.tls as a TLS client are affected. forge.tls servers are not affected.
What must an attacker be able to do to trigger the failure?
A malicious server or an on-path attacker must be able to deliver a handshake record while the client connection has no session. This can occur after close_notify, after the application calls close(), before handshake() is called, or after a reset on an unencrypted connection.
What is the practical impact of successful exploitation?
The crafted record can cause an uncaught TypeError to propagate from connection.process(), terminating the Node.js process if the application does not catch the exception. The issue does not affect confidentiality or integrity.
How can I determine whether an installation needs the fix?
Installations using a node-forge version earlier than 1.4.3 are affected. Version 1.4.3 contains the fix.