CVE-2026-125332

### Summary A `forge.tls` client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes `connection.process()` throw an uncaught `Error` when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details The client's ClientHello offers only the `null` compression method. `tls.parseHelloMessage()` in `lib/tls.js` stores the ServerHello's `compression_method` for the client without checking it (the code has a `TODO: handle compression methods`). When the client handles ServerHelloDone it calls `tls.createConnectionState()`, which throws `Error('Unsupported compression algorithm.')` for any method other than `null` (0) and `deflate` (1). The exception propagates out of `connection.process()`. The ServerHello isn't authenticated until the server's Finished message, so an on-path attacker can change the compression byte of a genuine ServerHello; the certificate chain still verifies. Applications that pass socket data to `process()` without catching exceptions terminate. This includes `forge.tls.wrapSocket`, which calls `process()` from its socket data handler, and `forge.http`, which uses it. A `deflate` (1) method, also never offered, makes the handshake fail later with an error instead of a crash. Servers are not affected: a server always selects no compression. The fix fails the handshake with an `illegal_parameter` alert, through the connection's `error` callback, when the ServerHello selects any compression method other than `null`. #### Patches Fixed in node-forge 1.4.3. #### Workarounds Catch exceptions thrown by `connection.process()` and close the socket. #### Resources - RFC 5246, section 7.4.1.3 (Server Hello): https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.3 - Related: GHSA-525v-9gp9-w22h (another TLS client crash during the handshake, fixed in 1.4.1): h