# CVE-2026-125332: Forge TLS client crash on unsupported ServerHello compression

Source: https://junglewise.ai/threats/cve-2026-125332-forge-also-called-node-forge-is-a-native-implementation-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125332 · Severity: medium · CVSS 5.9 · Published 2026-11-10

Forge is a JavaScript library that implements Transport Layer Security (TLS) for encrypting network communications. A malicious server or network attacker can crash a Node.js application using the Forge TLS client by sending a specially crafted ServerHello message with an unsupported compression method, causing an unhandled exception that terminates the process.

Technologies: [Digital Bazaar Forge](https://junglewise.ai/threats/technologies/forge), [node-forge (npm)](https://junglewise.ai/threats/technologies/node-forge). Vendors: [Digital Bazaar](https://junglewise.ai/threats/vendors/digital-bazaar), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-125332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125332 being exploited in the wild.

**How severe is CVE-2026-125332?** Medium severity, with a CVSS score of 5.9, published 10 November 2026.

**Which products and versions are affected?** Digital Bazaar Forge before 1.4.3; node-forge (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.4.3.

**Is there a fix for CVE-2026-125332?** Yes. node-forge (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125332 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125332?** Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- node-forge (npm): upgrade to 1.4.3 or later

  ```sh
  npm install node-forge@1.4.3
  ```


## Technical details

The Forge TLS client accepts any ServerHello compression method, even though it only offers "no compression." When processing ServerHelloDone, an unsupported compression method causes tls.createConnectionState() to throw an unhandled Error that propagates from connection.process(). The vulnerability affects direct forge.tls use, forge.tls.wrapSocket, and forge.http via network attack before server Finished authentication, but does not compromise confidentiality or integrity of encrypted data.

## Affected products

- Digital Bazaar Forge before 1.4.3

## Identifiers

- CVE-2026-125332
- GHSA-w4xr-hqv8-ch44

## Timeline

- 2026-11-10: disclosed
- 2026-11-04: patched

## References

- [https://github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef](https://github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef)
- [https://github.com/digitalbazaar/forge/pull/1169](https://github.com/digitalbazaar/forge/pull/1169)

## Related threats

- [Forge X.509 certificate chain verification ignores nameConstraints](https://junglewise.ai/threats/cve-2026-125336-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge: Ed25519 signature verification accepts small-order public keys](https://junglewise.ai/threats/cve-2026-125335-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge TLS client crash on handshake record without session](https://junglewise.ai/threats/cve-2026-125334-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge HTTP ReDoS in response header parsing](https://junglewise.ai/threats/cve-2026-125333-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding](https://junglewise.ai/threats/cve-2026-119192-forge-rsa-pkcs-1-v1-5-signature-forgery-via-non-canonical)