GHSA-525V-9GP9-W22H
Vulnerability from github – Published: 2026-10-30 23:02 – Updated: 2026-10-30 23:02Summary
The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malicious TLS server, or an on-path attacker who removes the server's Certificate message, can make connection.process() throw a TypeError, which crashes applications that use the forge TLS client. Fixed in node-forge 1.4.1.
Details
After ServerHelloDone, tls.handleServerHelloDone() in lib/tls.js is meant to reject a server that sent no certificate with a fatal insufficient_security alert, after consulting the application's verify callback. The check tested c.serverCertificate, which is never set (the certificate is stored as c.session.serverCertificate), so it never ran. The client state machine allows ServerHelloDone directly after ServerHello, so the handshake continued to tls.createClientKeyExchange(), which reads c.session.serverCertificate.publicKey and throws a TypeError on the null certificate. The exception propagates out of connection.process() without calling the verify or error callbacks.
There is no authentication bypass: without a server certificate the client cannot build its RSA key exchange, so the handshake cannot complete.
The fix reads c.session.serverCertificate and always fails the handshake in that case, still calling verify so the application can customize the alert. Failing even when verify returns true is needed because the key exchange requires the certificate.
Patches
Fixed in node-forge 1.4.1. The TLS client fails the handshake with an insufficient_security alert when the server sends no certificate.
Workarounds
Catch exceptions thrown by connection.process() in the code that feeds it network data, and close the connection when one occurs.
Credits
Reported by @arpitjain099.
Proof of concept
Connect a forge TLS client (forge.tls.createConnection({server: false, ...})) to a server whose first flight contains ServerHello and ServerHelloDone but no Certificate message. For example, run a forge TLS server and remove the Certificate handshake message (type 11) from its first flight before passing it to the client's process().
On 1.4.0 the client's process() throws "TypeError: Cannot read properties of null (reading 'publicKey')", and the verify and error callbacks are not called. On 1.4.1 the client calls verify with insufficient_security and no certificates, calls error with "No server certificate provided. Not enough security.", sends a fatal alert and closes the connection.
Regression tests are in tests/unit/tls.js ("missing server certificate").
Impact
Applications that use the forge TLS client (forge.tls.createConnection with server: false) are affected. A malicious server the application connects to, or an on-path attacker who can modify the unauthenticated handshake, can make the client throw from connection.process(). Since process() is normally called from a socket data handler, the uncaught exception terminates a Node.js process. There is no confidentiality or integrity impact. Applications using Node.js's own TLS implementation are not affected.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.4.0"
},
"package": {
"ecosystem": "npm",
"name": "node-forge"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-118778"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-30T23:02:30Z",
"nvd_published_at": "2026-10-29T19:17:20Z",
"severity": "MODERATE"
},
"details": "### Summary\nThe forge TLS client\u0027s check for a missing server certificate read the wrong property and never ran. A malicious TLS server, or an on-path attacker who removes the server\u0027s Certificate message, can make `connection.process()` throw a `TypeError`, which crashes applications that use the forge TLS client. Fixed in node-forge 1.4.1.\n\n### Details\nAfter ServerHelloDone, `tls.handleServerHelloDone()` in `lib/tls.js` is meant to reject a server that sent no certificate with a fatal `insufficient_security` alert, after consulting the application\u0027s `verify` callback. The check tested `c.serverCertificate`, which is never set (the certificate is stored as `c.session.serverCertificate`), so it never ran. The client state machine allows ServerHelloDone directly after ServerHello, so the handshake continued to `tls.createClientKeyExchange()`, which reads `c.session.serverCertificate.publicKey` and throws a `TypeError` on the null certificate. The exception propagates out of `connection.process()` without calling the `verify` or `error` callbacks.\n\nThere is no authentication bypass: without a server certificate the client cannot build its RSA key exchange, so the handshake cannot complete.\n\nThe fix reads `c.session.serverCertificate` and always fails the handshake in that case, still calling `verify` so the application can customize the alert. Failing even when `verify` returns `true` is needed because the key exchange requires the certificate.\n\n#### Patches\nFixed in node-forge 1.4.1. The TLS client fails the handshake with an `insufficient_security` alert when the server sends no certificate.\n\n#### Workarounds\nCatch exceptions thrown by `connection.process()` in the code that feeds it network data, and close the connection when one occurs.\n\n#### Credits\nReported by @arpitjain099.\n\n### Proof of concept\nConnect a forge TLS client (`forge.tls.createConnection({server: false, ...})`) to a server whose first flight contains ServerHello and ServerHelloDone but no Certificate message. For example, run a forge TLS server and remove the Certificate handshake message (type 11) from its first flight before passing it to the client\u0027s `process()`.\n\nOn 1.4.0 the client\u0027s `process()` throws \"TypeError: Cannot read properties of null (reading \u0027publicKey\u0027)\", and the `verify` and `error` callbacks are not called. On 1.4.1 the client calls `verify` with `insufficient_security` and no certificates, calls `error` with \"No server certificate provided. Not enough security.\", sends a fatal alert and closes the connection.\n\nRegression tests are in tests/unit/tls.js (\"missing server certificate\").\n\n### Impact\nApplications that use the forge TLS client (`forge.tls.createConnection` with `server: false`) are affected. A malicious server the application connects to, or an on-path attacker who can modify the unauthenticated handshake, can make the client throw from `connection.process()`. Since `process()` is normally called from a socket data handler, the uncaught exception terminates a Node.js process. There is no confidentiality or integrity impact. Applications using Node.js\u0027s own TLS implementation are not affected.",
"id": "GHSA-525v-9gp9-w22h",
"modified": "2026-10-30T23:02:30Z",
"published": "2026-10-30T23:02:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118778"
},
{
"type": "WEB",
"url": "https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888"
},
{
"type": "PACKAGE",
"url": "https://github.com/digitalbazaar/forge"
},
{
"type": "WEB",
"url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Forge: TLS client crash when the server sends no certificate"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.