NULL Pointer Dereference Affecting org.webjars.npm:node-forge package, versions [,1.4.1)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGWEBJARSNPM-22113971
- published1 Nov 2026
- disclosed26 Oct 2026
- creditUnknown
Introduced: 26 Oct 2026
NewCVE-2026-119188 (opens in a new tab)How to fix?
Upgrade org.webjars.npm:node-forge to version 1.4.1 or higher.
Overview
org.webjars.npm:node-forge is a WebJar for node-forge.
Affected versions of this package are vulnerable to NULL Pointer Dereference in the _readRecord function in lib/tls.js. An attacker can terminate the peer's Node.js process by sending a handshake message fragmented across records and then interleaving a record of another content type such as an alert, change_cipher_spec, application_data, or heartbeat, because the resulting fatal error sets c.record to null while _readRecord() continues and assigns c.record.ready = true, throwing an uncaught TypeError out of process(). This affects any forge.tls connection in server or client mode, including those from wrapSocket, forge.http, and forge.xhr, and the crash lands when process() is driven from a Node.js socket data handler as in the documented usage.