CPU designers expect that programs will rarely, if ever, access unmapped addresses. Therefore, the TLB usually1 does not cache the fact that an address is unmapped. If the program does access an unmapped address, you'll have an ordinary TLB miss followed by a lookup failure in the actual page table, and it's the lookup failure that triggers the page fault. Similarly, if a page is mapped but not present, it won't1 be in the TLB, because the expectation is that the cost of making the page present again will dwarf the cost of a page table lookup.
However, the TLB can cache the fact that a page is mapped read-only, non-executable, supervisor only, etc., so you can get page faults triggered directly by the TLB in those cases.
1 I don't know every CPU design, it's possible that somebody somewhere tried making the TLB cache these things, but it's rare enough that I can't think of an example.