A denial of service vulnerability exists in node-forge's TLS implementation due to recursive processing of TLS records, which can exhaust the call stack. An attacker can send a chunk of thousands of small TLS records (e.g., heartbeat records) before handshake completion, causing a RangeError that terminates Node.js processes using the documented socket wiring. This flaw affects both client and server connections. The issue is fixed in node-forge version 1.4.1 by changing the processing to an iterative approach.