NULL Pointer Dereference Affecting node-forge package, versions <1.4.3

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to NULL Pointer Dereference via tls.handleHandshake() in lib/tls.js, which attempts to update handshake digests via c.session.md5.update(bytes) when c.session is null. A client's session is set to null by c.reset() after a close_notify alert or a call to close(), and is also absent before handshake() is called. A malicious server or an on-path attacker can send a ServerHello record in any of these states, causing an uncaught TypeError to propagate out of connection.process() and terminate the Node.js process.

Note: Only forge.tls clients are affected; servers are not vulnerable because a server creates its session upon receiving a ClientHello.

var c = forge.tls.createConnection({server: false, ...});
    c.handshake();
    // warning close_notify alert, then an empty ServerHello, in separate
    // process() calls
    c.process(forge.util.hexToBytes('15030100020100'));
    c.process(forge.util.hexToBytes('160301000402000000'));
    // <= 1.4.2: TypeError: Cannot read properties of null (reading 'md5')
    // 1.4.3: the record is ignored

The reporter's PoC is in tests/pocs/ghsa-j8rw-jp99-435v.js, and regression tests are in tests/unit/tls.js.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release