CVE-2026-33896
Forge (also called ) is a native implementation of Transport Layer Security in JavaScript.
Published Mar 27, 2026 · updated Sep 4, 2026 · digitalbazaar forge
Forge (also called ) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the and extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
Forge (also called ) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the and extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches
Sep 4, 2026 · NIST NVD
Updated
Forge (also called ) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the and extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches
Affected
- cpe digitalbazaar/forgeversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33896
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33896
Forge (also called ) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the
nvd.nist.gov