Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

Summary A connection created with forge.tls.createConnection() throws an uncaught TypeError from process() when it receives a record of another content type while waiting for the rest of a handshake message that was split across records. A peer can trigger this with 18 bytes before the handshake, without authentication, which terminates Node.js processes that use the documented socket wiring. Fixed in node-forge 1.4.1. Details In lib/tls.js, readRecord() handles a record that arrives while a handshake message split across records is incomplete. If the record has any other content type (changecipherspec, alert, applicationdata or heartbeat), forge correctly reports "Invalid fragmented record." through c.error() with a fatal unexpectedmessage alert. That fatal error closes and resets the connection, which sets c.record to null. readRecord() then continues with c.record.ready = true and throws TypeError: Cannot set properties of null (setting 'ready') out of process(). The code is unchanged since the first release. RFC 5246 section 6.2.1 allows a handshake message to be fragmented across records, and RFC 8446 section 5.1 forbids interleaving handshake messages with other record…

curl https://cve.zerocrew.in/api/cve/CVE-2026-119188