CVE-2026-119187
node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 30, 2026
Updated · November 3, 2026
Description
A flaw was found in node-forge. The Transport Layer Security (TLS) implementation processes incoming records through recursive function calls instead of an iterative loop. An unauthenticated remote attacker can exploit this flaw by sending a network payload containing a large number of small TLS records. This triggers excessive recursion that exhausts the call stack, causing an unhandled crash and leading to a Denial of Service (DoS).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 · Allocation of Resources Without Limits or Throttling