CVE-2026-33896 in forge
Сводка (Английский)
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Раскрытие
27.03.2026
Статус
Подтверждённый
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 353827 | digitalbazaar forge Certificate Chain слабая аутентификация | 295 | Не определено | Официальное исправление | CVE-2026-33896 |