# CVE-2026-125334: Forge TLS client crash on handshake record without session

Source: https://junglewise.ai/threats/cve-2026-125334-forge-also-called-node-forge-is-a-native-implementation-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125334 · Severity: medium · CVSS 5.9 · Published 2026-11-10

Forge is a JavaScript library that implements Transport Layer Security (TLS) for secure communications. A malicious server or network attacker can send a specially crafted TLS handshake message to a Forge TLS client after the connection is closed or before it is established, causing the client process to crash. Applications that do not catch this exception will experience denial of service.

Technologies: [Digital Bazaar Forge](https://junglewise.ai/threats/technologies/forge), [node-forge (npm)](https://junglewise.ai/threats/technologies/node-forge). Vendors: [Digital Bazaar](https://junglewise.ai/threats/vendors/digital-bazaar), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-125334 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125334 being exploited in the wild.

**How severe is CVE-2026-125334?** Medium severity, with a CVSS score of 5.9, published 10 November 2026.

**Which products and versions are affected?** Digital Bazaar Forge before 1.4.3; node-forge (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.4.3.

**Is there a fix for CVE-2026-125334?** Yes. node-forge (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125334 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-125334?** Check whether you run Digital Bazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- node-forge (npm): upgrade to 1.4.3 or later

  ```sh
  npm install node-forge@1.4.3
  ```


## Technical details

A TLS client in Forge versions before 1.4.3 crashes with a TypeError when the tls.handleHandshake() function attempts to dereference c.session.md5 while the connection has no active session (before handshake() is called, after close_notify alert, or after close() is called). A network attacker can deliver a handshake record to trigger this, including after connection reset when no encryption is active. The fix ignores handshake messages received by a client without an active session.

## Affected products

- Digital Bazaar Forge before 1.4.3

## Identifiers

- CVE-2026-125334
- GHSA-j8rw-jp99-435v

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c](https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c)
- [https://github.com/digitalbazaar/forge/pull/1169](https://github.com/digitalbazaar/forge/pull/1169)

## Related threats

- [Forge X.509 certificate chain verification ignores nameConstraints](https://junglewise.ai/threats/cve-2026-125336-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge: Ed25519 signature verification accepts small-order public keys](https://junglewise.ai/threats/cve-2026-125335-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge HTTP ReDoS in response header parsing](https://junglewise.ai/threats/cve-2026-125333-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge TLS client crash on unsupported ServerHello compression](https://junglewise.ai/threats/cve-2026-125332-forge-also-called-node-forge-is-a-native-implementation-of)
- [Forge RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding](https://junglewise.ai/threats/cve-2026-119192-forge-rsa-pkcs-1-v1-5-signature-forgery-via-non-canonical)