Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Description

pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.3.3
• Patched version(s): 1.4.0

References

• GHSA-2328-f5f3-gj25
• CVE-2026-33896
• CWE-295
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input - CVE-2026-33891
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939
• Forge has signature forgery in Ed25519 due to missing S > L check - CVE-2026-33895
• node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - CVE-2025-12816

Tags:

npm

node-forge