CVE-2026-33896 — Improper Certificate Validation in Forge
Severity
7.4HIGHNVD
EPSS
0.0%
top 94.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 27
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2
Affected Packages1 packages
🔴Vulnerability Details
3OSV▶
CVE-2026-33896: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript↗2026-03-27
GHSA▶
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)↗2026-03-26
OSV▶
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)↗2026-03-26
📋Vendor Advisories
1Red Hat▶
node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance↗2026-03-27
🕵️Threat Intelligence
1💬Community
4Bugzilla▶
CVE-2026-33896 fbthrift: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [fedora-all]↗2026-03-27
Bugzilla▶
CVE-2026-33896 cachelib: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [fedora-all]↗2026-03-27
Bugzilla▶
CVE-2026-33896 cachelib: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [epel-all]↗2026-03-27
Bugzilla▶
CVE-2026-33896 fbthrift: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [epel-all]↗2026-03-27