Is CVE-2026-125332 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125332 being exploited in the wild.

How severe is CVE-2026-125332?

Medium severity, with a CVSS score of 5.9, published 10 November 2026.

Which products and versions are affected?

Digital Bazaar Forge before 1.4.3; node-forge (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.4.3.

Is there a fix for CVE-2026-125332?

Yes. node-forge (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125332 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-125332?

Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125332: Forge TLS client crash on unsupported ServerHello compression

Q: Is there a fix for CVE-2026-125332?

Yes. node-forge (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-125332 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-125332?

Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125332 · Severity: medium · CVSS 5.9 · Published 2026-11-10

Forge is a JavaScript library that implements Transport Layer Security (TLS) for encrypting network communications. A malicious server or network attacker can crash a Node.js application using the Forge TLS client by sending a specially crafted ServerHello message with an unsupported compression method, causing an unhandled exception that terminates the process.

Technologies: Digital Bazaar Forge, node-forge (npm). Vendors: Digital Bazaar, npm.

Quick answers

Is CVE-2026-125332 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125332 being exploited in the wild.
How severe is CVE-2026-125332?: Medium severity, with a CVSS score of 5.9, published 10 November 2026.
Which products and versions are affected?: Digital Bazaar Forge before 1.4.3; node-forge (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.4.3.
Is there a fix for CVE-2026-125332?: Yes. node-forge (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125332 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-125332?: Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-forge (npm): upgrade to 1.4.3 or later
```
npm install node-forge@1.4.3
```

Technical details

The Forge TLS client accepts any ServerHello compression method, even though it only offers "no compression." When processing ServerHelloDone, an unsupported compression method causes tls.createConnectionState() to throw an unhandled Error that propagates from connection.process(). The vulnerability affects direct forge.tls use, forge.tls.wrapSocket, and forge.http via network attack before server Finished authentication, but does not compromise confidentiality or integrity of encrypted data.

Affected products

Digital Bazaar Forge before 1.4.3

Identifiers

CVE-2026-125332
GHSA-w4xr-hqv8-ch44

Timeline

2026-11-10: disclosed
2026-11-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.