CVE-2026-119189 in Forge
Summary
by MITRE • 10/29/2026
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in the node-forge library, a native implementation of Transport Layer Security written in JavaScript, stems from an incomplete enforcement of X.509 certificate validation rules regarding path length constraints. Specifically, prior to version 1.4.1, the cryptographic verification logic failed to validate the basicConstraints.pathLenConstraint attribute on Certificate Authority certificates unless those certificates also included a keyUsage extension. This conditional check creates a significant gap in the chain-of-trust verification process, allowing attackers to bypass critical security boundaries defined by certificate policies. The flaw is rooted in how the library parses and validates X.509 structures, specifically neglecting to apply path length restrictions when certain optional extensions are absent from intermediate CA certificates.
From an operational perspective, this vulnerability enables a Certificate Forgery attack where an adversary can construct a valid-looking certificate chain that exceeds the maximum allowed depth defined by the issuing CA's policy. For exploitation to succeed, two primary conditions must be met: first, there must exist a trusted root or intermediate CA within the application's trust store that has issued certificates without including the keyUsage extension; second, an attacker must possess the private key of such a CA or have obtained a subordinate certificate from it. In public web PKI environments, this risk is generally low because major Certificate Authorities strictly adhere to industry standards and include mandatory extensions like keyUsage in their CA certificates. However, internal or private Public Key Infrastructure deployments are at higher risk, as they may generate CA certificates using default configurations that omit optional fields for simplicity or legacy compatibility reasons.
The security impact of this flaw is severe, as it allows an attacker to impersonate any entity within the hierarchy below the vulnerable CA, effectively breaking the integrity and authenticity guarantees provided by TLS. An attacker could issue a certificate for a domain they do not own, which would be accepted as valid by applications using node-forge versions prior to 1.4.1. This undermines mutual authentication mechanisms and can lead to unauthorized access, data interception, or man-in-the-middle attacks against services relying on this library for secure communications. The absence of the keyUsage extension does not imply that the CA lacks signing capabilities; rather, it means the certificate is technically valid under older interpretations of X.509 standards where extensions were optional. However, modern security practices and RFC 5280 emphasize the importance of explicit constraints to prevent such escalation attacks.
This vulnerability maps directly to CWE-271, which describes a privilege assignment issue where insufficient enforcement occurs during validation processes. It also aligns with MITRE ATT&CK technique T1606, Forge Web Certificates, specifically under the subtechnique for forging X.509 certificates to bypass authentication mechanisms. The failure to enforce path length constraints is a classic example of how incomplete checks in cryptographic libraries can lead to systemic trust violations. Organizations relying on node-forge must recognize that while public PKI ecosystems are largely protected by strict CA/Browser Forum baselines, internal systems using custom or legacy certificate generation tools remain vulnerable if they do not explicitly include all required extensions during certificate issuance.
To mitigate this risk, organizations should immediately upgrade to version 1.4.1 of node-forge, which corrects the validation logic to enforce path length constraints regardless of the presence of other extensions like keyUsage. Additionally, security teams auditing their internal PKI infrastructure should review CA certificates for missing mandatory or recommended extensions and regenerate them with proper policy definitions if necessary. Implementing strict certificate transparency monitoring and regular audits of trust stores can further help detect any anomalous certificate chains that might exploit similar weaknesses in other components of the cryptographic stack. Ensuring that all intermediate CAs include comprehensive extension sets not only resolves this specific issue but also hardens the overall PKI against a broader range of validation bypass attacks.