CVE-2026-33896
published 2026-03-27CVE-2026-33896: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()`…
PriorityP353critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.35%
27.1th percentile
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| digitalbazaar | forge | < 1.4.0 | 1.4.0 |
| digitalbazaar | forge | <= 1.3.3 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
osv7.4HIGH
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance
vendor_redhat·2026-03-27·CVSS 7.4
CVE-2026-33896 [HIGH] CWE-295 node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance
node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
A flaw was found in Forge (also known as node-forge), a JavaScript implementation of Transport Layer Security (TLS). The `pki.verifyCertificateChain()` function does not properly enforce certificate validation r
VulDB
digitalbazaar forge 1.3.2 Certificate Chain certificate validation (Nessus ID 304071 / WID-SEC-2026-1407)
vuldb·2026-06-20·CVSS 9.1
CVE-2026-33896 [CRITICAL] digitalbazaar forge 1.3.2 Certificate Chain certificate validation (Nessus ID 304071 / WID-SEC-2026-1407)
A vulnerability was found in digitalbazaar forge 1.3.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Certificate Chain Handler. The manipulation results in improper certificate validation.
This vulnerability is identified as CVE-2026-33896. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
OSV
CVE-2026-33896: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
osv·2026-03-27·CVSS 7.4
CVE-2026-33896 [HIGH] CVE-2026-33896: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
GHSA
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
ghsa·2026-03-26
CVE-2026-33896 [HIGH] CWE-295 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
## Summary
`pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.
## Technical Details
In `lib/x509.js`, the `verifyCertificateChain()` function (around lines 3147-3199) has two conditional checks for CA authorization:
1. The `keyUsage` check (which includes a sub-check requiring `basicConstraints` to be present) is gated on `keyUsageExt !== null`
2. The `basicConstraints.cA` check is gated on `bcExt !== null`
When a certifica
OSV
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
osv·2026-03-26
CVE-2026-33896 [HIGH] Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
## Summary
`pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.
## Technical Details
In `lib/x509.js`, the `verifyCertificateChain()` function (around lines 3147-3199) has two conditional checks for CA authorization:
1. The `keyUsage` check (which includes a sub-check requiring `basicConstraints` to be present) is gated on `keyUsageExt !== null`
2. The `basicConstraints.cA` check is gated on `bcExt !== null`
When a certifica
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33896 fbthrift: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [fedora-all]
bugzilla·2026-03-27·CVSS 7.4
CVE-2026-33896 [HIGH] CVE-2026-33896 fbthrift: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [fedora-all]
CVE-2026-33896 fbthrift: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This project only ships JavaScript code as part of the website, the files are not shipped in the binary RPMs
Bugzilla
CVE-2026-33896 cachelib: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [fedora-all]
bugzilla·2026-03-27·CVSS 7.4
CVE-2026-33896 [HIGH] CVE-2026-33896 cachelib: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [fedora-all]
CVE-2026-33896 cachelib: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This project only ships JavaScript code as part of the website, the files are not shipped in the binary RPMs
Bugzilla
CVE-2026-33896 node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance
bugzilla·2026-03-27·CVSS 9.1
CVE-2026-33896 [CRITICAL] CVE-2026-33896 node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance
CVE-2026-33896 node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Discussion:
This issue has been addressed in the following products:
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Ansible Automation Platform 2.5 for RHEL 8
Via RHSA-2026:24761 ht
Bugzilla
CVE-2026-33896 cachelib: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [epel-all]
bugzilla·2026-03-27·CVSS 7.4
CVE-2026-33896 [HIGH] CVE-2026-33896 cachelib: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [epel-all]
CVE-2026-33896 cachelib: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This project only ships JavaScript code as part of the website, the files are not shipped in the binary RPMs
Bugzilla
CVE-2026-33896 fbthrift: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [epel-all]
bugzilla·2026-03-27·CVSS 7.4
CVE-2026-33896 [HIGH] CVE-2026-33896 fbthrift: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [epel-all]
CVE-2026-33896 fbthrift: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This project only ships JavaScript code as part of the website, the files are not shipped in the binary RPMs
Wiz
CVE-2026-33896 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.4
CVE-2026-33896 [HIGH] CVE-2026-33896 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33896 :
JavaScript vulnerability analysis and mitigation
node-forge
pki.verifyCertificateChain()
basicConstraints
keyUsage
Source : NVD
## 7.4
Score
Published March 27, 2026
Severity HIGH
CNA Score 7.4
Affected Technologies
JavaScript
Grafana
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kibana-8.17
kibana-9.0
Sources
NVD
Chainguard Has Fix Added at: Apr 02, 2026
npm Severity HIGH Has Fix Added at: Mar 29, 2026
MinimOS Severity HIGH Has Fix Added at: Apr 05, 2026
Red Hat 8, 9, 10 Severity HIGH No Fix Added at: Mar 29, 2026
Wolfi Has Fix Added at: Apr 02, 2026
## Get a CVE risk assessmen
https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25https://access.redhat.com/errata/RHSA-2026:13826https://access.redhat.com/errata/RHSA-2026:24761https://access.redhat.com/errata/RHSA-2026:34342https://access.redhat.com/errata/RHSA-2026:9742https://access.redhat.com/security/cve/CVE-2026-33896https://bugzilla.redhat.com/show_bug.cgi?id=2452458https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33896.json
2026-03-27
Published