CVE-2026-119188: 
Grafana vulnerability analysis and mitigation

CVE-2026-119188 is a Denial of Service vulnerability in node-forge (also called Forge), a native JavaScript implementation of Transport Layer Security. The flaw exists in versions up to and including 1.4.0, where the library's TLS implementation fails to properly handle a TLS record of a different content type that interrupts a fragmented handshake message, resulting in an uncaught TypeError that can crash the hosting Node.js process. It was disclosed on October 27, 2026, and fixed in version 1.4.1. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an uncaught exception (CWE-248) combined with a null pointer dereference (CWE-476) in lib/tls.js. When _readRecord() processes a TLS record of a different content type (e.g., alert, change_cipher_spec, application_data, or heartbeat) while a handshake message is fragmented across records, it correctly reports an "Invalid fragmented record." error and resets the connection — setting c.record to null. However, execution continues and attempts c.record.ready = true, throwing TypeError: Cannot set properties of null. The fix (commit 700d977) adds an early return immediately after the fatal error handling in _readRecord(), preventing further execution. Because node-forge's design relies on error callbacks rather than exceptions, applications following the documented socket wiring pattern do not wrap process() in try/catch, making the exception uncaught (GitHub Advisory, Fix Commit).

Successful exploitation results in a complete availability impact with no confidentiality or integrity loss. An unauthenticated remote attacker can terminate the entire Node.js process by sending just 18 bytes, dropping all connections the process serves. Because the attack can be repeated on every restart, it enables persistent denial of service against any application using forge.tls.createConnection(), forge.tls.wrapSocket(), or the forge.http/forge.xhr TLS paths (GitHub Advisory).

A proof-of-concept is publicly available in the GitHub Security Advisory, consisting of a specific 18-byte hex payload that reliably triggers the crash with no authentication or user interaction required. The EPSS score is 0.0 at time of publication, and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion as of the disclosure date (GitHub Advisory, Feedly).

1. Identify target: Locate a network-accessible service running a Node.js application that uses node-forge version ≤ 1.4.0 for TLS, particularly one using forge.tls.createConnection() or forge.tls.wrapSocket() with the standard socket data handler pattern.
2. Craft the malicious payload: Construct two TLS records totaling 18 bytes — a handshake record announcing more bytes than it carries (e.g., 16 03 01 00 06 01 00 00 10 03 01 — a ClientHello header announcing 16 bytes but containing only 2), followed by a record of a different content type (e.g., 15 03 01 00 02 02 28 — an alert record).
3. Deliver the payload: Send the crafted bytes to the target TLS endpoint before completing the handshake. No authentication is required.
4. Trigger the crash: The target's _readRecord() processes the interleaved record, calls c.error() which resets c.record to null, then attempts c.record.ready = true, throwing an uncaught TypeError that terminates the Node.js process.
5. Repeat for persistence: Since the crash terminates the process and drops all connections, the attacker can repeat the attack on every restart to maintain a persistent denial of service (GitHub Advisory).

• Network: Inbound TLS connections that send exactly 18 bytes and immediately close; specifically, a TLS handshake record (content type 0x16) followed immediately by an alert (0x15), change_cipher_spec (0x14), application_data (0x17), or heartbeat (0x18) record before the handshake completes.
• Logs: Node.js process crash logs containing TypeError: Cannot set properties of null (setting 'ready') originating from lib/tls.js in the node-forge module; error callback logs showing "Invalid fragmented record." immediately before a process exit.
• Process: Unexpected termination of Node.js processes serving TLS connections; repeated process restarts (e.g., via process managers like PM2 or systemd) in short succession without other apparent cause (GitHub Advisory).

Upgrade node-forge to version 1.4.1 or later, which adds an early return in _readRecord() after the fatal error to prevent the null dereference. As a temporary workaround if immediate patching is not possible, wrap every call to connection.process() in a try/catch block — the exception can be safely ignored or the socket destroyed, as the connection has already been failed and closed when the exception is thrown. Additionally, consider implementing connection timeouts and rate limiting on TLS endpoints to reduce exposure (GitHub Advisory, Release v1.4.1).

The advisory was authored by davidlehn of the digitalbazaar organization and published on October 27, 2026. Red Hat tracked the issue via Bugzilla (bug #2563661) and published a CVE entry, indicating downstream package maintainers are aware and assessing impact. No significant independent researcher commentary or broad media coverage has been identified beyond standard vulnerability database aggregation (GitHub Advisory, Red Hat CVE).