Is CVE-2026-125334 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125334 being exploited in the wild.

How severe is CVE-2026-125334?

Medium severity, with a CVSS score of 5.9, published 10 November 2026.

Which products and versions are affected?

Digital Bazaar Forge before 1.4.3; node-forge (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.4.3.

Is there a fix for CVE-2026-125334?

Yes. node-forge (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125334 attacked?

It is attacked over the network.

Am I affected by CVE-2026-125334?

Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125334: Forge TLS client crash on handshake record without session

Q: Is there a fix for CVE-2026-125334?

Yes. node-forge (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-125334 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-125334?

Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125334 · Severity: medium · CVSS 5.9 · Published 2026-11-10

Forge is a JavaScript library that implements Transport Layer Security (TLS) for secure communications. A malicious server or network attacker can send a specially crafted TLS handshake message to a Forge TLS client after the connection is closed or before it is established, causing the client process to crash. Applications that do not catch this exception will experience denial of service.

Technologies: Digital Bazaar Forge, node-forge (npm). Vendors: Digital Bazaar, npm.

Quick answers

Is CVE-2026-125334 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125334 being exploited in the wild.
How severe is CVE-2026-125334?: Medium severity, with a CVSS score of 5.9, published 10 November 2026.
Which products and versions are affected?: Digital Bazaar Forge before 1.4.3; node-forge (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.4.3.
Is there a fix for CVE-2026-125334?: Yes. node-forge (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125334 attacked?: It is attacked over the network.
Am I affected by CVE-2026-125334?: Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-forge (npm): upgrade to 1.4.3 or later
```
npm install node-forge@1.4.3
```

Technical details

A TLS client in Forge versions before 1.4.3 crashes with a TypeError when the tls.handleHandshake() function attempts to dereference c.session.md5 while the connection has no active session (before handshake() is called, after close_notify alert, or after close() is called). A network attacker can deliver a handshake record to trigger this, including after connection reset when no encryption is active. The fix ignores handshake messages received by a client without an active session.

Affected products

Digital Bazaar Forge before 1.4.3

Identifiers

CVE-2026-125334
GHSA-j8rw-jp99-435v

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.