CVE-2026-119187: 
Grafana vulnerability analysis and mitigation

CVE-2026-119187 is a denial-of-service vulnerability in node-forge (also called Forge), a native JavaScript implementation of Transport Layer Security. The flaw causes the TLS record processing function c.process() to recurse uncontrollably — consuming one JavaScript call stack frame per TLS record — allowing a remote, unauthenticated attacker to crash the host Node.js process by sending a single chunk of thousands of small TLS records. All versions of node-forge prior to 1.4.1 are affected. The vulnerability was disclosed on October 27, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is uncontrolled recursion (CWE-674) combined with allocation of resources without limits or throttling (CWE-770) in lib/tls.js. In the vulnerable implementation, c.process() reads one TLS record, passes it to _update(), which dispatches to a type-specific handler (e.g., tls.handleHeartbeat, tls.handleApplicationData, tls.handleHandshake); each handler then calls c.process() again to continue with the next buffered record, adding three stack frames per record. Critically, heartbeat records are accepted in every TLS state — including before the handshake — so no authentication or valid handshake is required. On Node.js 24, approximately 2,300 eight-byte records (under 20 KB) in a single input chunk are sufficient to trigger RangeError: Maximum call stack size exceeded; because node-forge routes TLS errors through callbacks rather than exceptions, applications typically do not wrap process() in try/catch, causing the exception to be uncaught and terminating the process (GitHub Advisory, Fix Commit).

Successful exploitation causes an uncaught RangeError that terminates the entire Node.js process, dropping all connections it serves. Repeated small payloads (under 40 KB each) can keep the service continuously unavailable. In browser environments, the impact is limited to the single attacked TLS connection. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting any application that uses forge.tls.createConnection(), forge.tls.wrapSocket(), or the forge.http/forge.xhr TLS connections (GitHub Advisory).

A concrete proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating stack exhaustion with 5,000 eight-byte heartbeat records (~40 KB) in a single c.process() call. The exploit requires no authentication, no prior handshake, and no user interaction, making it trivially weaponizable by any network-reachable attacker. The EPSS score is currently 0.0, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify applications using node-forge versions ≤ 1.4.0 for TLS connections (e.g., via npm dependency scanning, Shodan for exposed services, or reviewing open-source project dependencies).
2. Establish a network connection: Open a TCP connection to the target forge TLS server (or act as a malicious server that a forge TLS client connects to). No handshake is required.
3. Craft the malicious payload: Construct a binary string of ~5,000 concatenated eight-byte TLS heartbeat records using the byte sequence 18 03 01 00 03 01 00 00 (content type 24 = heartbeat, TLS 1.0, length 3, heartbeat_request with 0-byte payload):

   var rec = forge.util.hexToBytes('1803010003010000');
   var payload = new Array(5001).join(rec); // 5,000 records, 40,000 bytes

4. Send the payload: Transmit the ~40 KB payload as a single data chunk to the target's socket data handler, which passes it directly to c.process().
5. Stack exhaustion: c.process() recurses once per record through _update() → handler → c.process(), exhausting the JavaScript call stack at approximately 2,300 records on Node.js 24, throwing RangeError: Maximum call stack size exceeded.
6. Process crash: Because the exception is uncaught (no try/catch around process() in the documented usage pattern), the Node.js process terminates, dropping all active connections. Repeating the payload keeps the service down (GitHub Advisory).

• Network: Inbound TCP connections sending a single large data chunk (~20–40 KB) consisting of repeated 8-byte TLS records (hex pattern 1803010003010000 or 1803010003020000) before any TLS handshake completes; unusual volume of short-lived connections to forge TLS endpoints.
• Logs: Node.js process crash logs containing RangeError: Maximum call stack size exceeded with a stack trace rooted in tls.js functions such as c.process, _update, or tls.handleHeartbeat; application restart events or process manager (e.g., PM2, systemd) logs showing repeated unexpected restarts.
• Process: Abrupt termination of the Node.js process without a graceful shutdown signal; monitoring tools (e.g., APM agents) reporting unhandled exception events from within TLS data handlers (GitHub Advisory).

The primary remediation is to upgrade node-forge to version 1.4.1 or later, which refactors c.process() to process TLS records iteratively in a loop rather than recursively, eliminating the stack depth dependency on record count (Fix Commit, v1.4.1 Release). For applications that cannot immediately upgrade, the advisory recommends wrapping every call to connection.process() in a try/catch block and, on catching an exception, calling connection.close() and destroying the underlying socket — this prevents the process crash but still loses the attacked connection. Additionally, implementing rate limiting or connection filtering to restrict the number of TLS records accepted from a single peer in a short time window can reduce exposure (GitHub Advisory).

The vulnerability was reported jointly by Ziyue Wang, Chenchen, Strick Sheng, Liyi Zhou, and Maurice Ng, and was published by maintainer davidlehn on October 27, 2026. Red Hat tracked the issue via Bugzilla (bug #2563659) and published a CVE advisory page, indicating downstream package impact assessment is underway (Red Hat CVE). The advisory notes a related prior vulnerability (CVE-2025-66031 / GHSA-554w-wpv2-vw27) involving ASN.1 unbounded recursion fixed in node-forge 1.3.2, suggesting a pattern of recursive processing issues in the library.