CVE intelligence

CVE-2026-125332

Vulnerability intelligence

Published Nov 10, 2026Sources checked Nov 13, 2026

5.9MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2026-125332 and is rated Medium severity with a CVSS score of 5.9. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Nov 13, 2026

Release Notes

CISA KEVNot listedBased on the latest collected catalog

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-125332?

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer.

When the client later handles ServerHelloDone, tls.createConnectionState() rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message and terminate a Node.js process when the application does not catch the exception.

The affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http; forge.tls servers are not affected, and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3.

Source: NVD