The vulnerability is caused by a wrong null‑check in the node‑forge TLS client. When a server omits the Certificate message, the client dereferences a missing certificate, leading to an uncaught exception and a crash of the connection or the entire process. The result is an unplanned termination of the application, effectively a denial‑of‑service.

The affected product is the node‑forge library (also known as forge) provided by Digital Bazaar. Any JavaScript or Node.js application that imports forge and uses forge.tls.createConnection() is vulnerable when running a version earlier than 1.4.1. The fix was released in version 1.4.1 and later.

The CVSS score of 5.9 classifies the risk as medium. No EPSS information is available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower exploitation probability in the wild. Based on the description, it is inferred that an attacker controlling a TLS server or acting as a man‑in‑the‑middle could omit the Certificate message, leading to the crash. Therefore the common threat is a network‑based denial‑of‑service that could disrupt services relying on node‑forge.