node-forge: TLS client crash on unsupported ServerHello compression method
Summary
Forge (node-forge) is a JavaScript TLS implementation. Prior to version 1.4.3, a forge.tls client accepts a ServerHello compression method it did not offer, and later throws an uncaught error during the handshake. A malicious server or an on-path attacker can use this to terminate a Node.js process that does not catch the exception. The issue affects client paths such as forge.tls, forge.tls.wrapSocket and forge.http; forge.tls servers are not affected, and there is no confidentiality or integrity impact.
Affected
- node-forge (forge) versions before 1.4.3
- Only Node.js applications acting as TLS clients (forge.tls, forge.tls.wrapSocket, forge.http)
- forge.tls servers are not affected
Fixed in
- Version 1.4.3
Workaround
- Unknown.
- If upgrading is delayed, make sure the application catches exceptions from the TLS processing call so that an unexpected handshake message cannot terminate the Node.js process.
Exploitation
- No public exploitation or exploitation in the wild known.
- The reporter's proof of concept is in the upstream test folder; it has not been reproduced here.
Our recommendation
- Update node-forge to version 1.4.3 as part of routine dependency updates; the same release also contains a HIGH-severity X.509 name-constraints fix (GHSA-3cc4-3294-vgjf).
- Test the update before rollout, as it changes certificate chain validation and TLS handling.
- Check that production Node.js services using forge as a TLS client catch errors from TLS processing.
- Check whether node-forge is a runtime or only a development dependency in your projects.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 1d9816d github.com
- Release 1.4.3 pull request github.com
- Forge v1.4.3 release github.com
- GitHub Security Advisory GHSA-w4xr-hqv8-ch44 github.com
- OSV GHSA-w4xr-hqv8-ch44 osv.dev
- Forge CHANGELOG github.com
- GitLab advisory CVE-2026-125332 advisories.gitlab.com
- NPM package node-forge www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:10.
Original description (NVD)
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState() rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message and terminate a Node.js process when the application does not catch the exception. The affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http; forge.tls servers are not affected, and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.
NVD references (5)
- https://github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef
- https://github.com/digitalbazaar/forge/pull/1169
- https://github.com/digitalbazaar/forge/releases/tag/v1.4.3
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.