ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-119190

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · Forge: X.509 basicConstraints bypass

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119190. EPSS is 0.25%. Act only if a listed version of Forge: X.509 basicConstraints bypass is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Forge: X.509 basicConstraints bypass).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.25%
Remediation
Version ranges on file
Affected products
npm node-forge

### Summary node-forge parses certificate extensions with the deprecated OIDs and as , and used the first extension with that name. A certificate with a forged deprecated-OID extension ( TRUE) before its genuine extension ( FALSE) is accepted as a CA certificate, and the same technique can hide a . Fixed in node-forge 1.4.1. ### Details maps the deprecated certificate extension OIDs and to the name , the same name as the RFC 5280 extension . in decodes extensions by name, so these extensions are decoded into the same and fields. returns the first extension with a matching name, and looked up by name. As a result, a certificate that contains a (or ) extension with TRUE before its genuine extension with FALSE is accepted as a CA certificate. The same technique can hide a CA certificate's . A deprecated-OID extension on its own also satisfies the check added for GHSA-2328-f5f3-gj25 (CVE-2026-33896) that is present. RFC 5280 section 4.2.1.9 defines basicConstraints only as ( ), and the path validation checks in section 6.1.4 apply to that extension. The fix makes chain verification look up basicConstraints by OID ( ). This covers both the and the checks. Certificate parsing, the OID table and are unchanged. #### Patches Fixed in node-forge 1.4.1. Chain verification now uses only the extension with OID . #### Workarounds None in node-forge itself. Applications that pass an callback to (or to ) can reject chains in which a non-leaf certificate has no extension with TRUE, for example with . CA operators can avoid copying unrecognized extensions from certificate requests. #### Credits WorkOS Security Team· [security@workos.com](mailto:security@workos.com) (@nickcollisson-workos) ### Proof of concept Have a trusted CA issue an end-entity certificate whose extensions are, in this order: a (or ) extension with the value of a basicConstraints TRUE (DER ), then the CA's own basicConstraints with FALSE, and no . For example, with an extensions file that sets copies the extension

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm node-forge0 → 1.4.1
  • npm node-forge<= 1.4.0

How to fix CVE-2026-119190

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119190. EPSS is 0.25%. Act only if a listed version of Forge: X.509 basicConstraints bypass is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.4.1, <= 1.4.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-295: Improper Certificate Validation; CWE-436. EPSS 0.25%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Summary node-forge parses certificate extensions with the deprecated OIDs and as , and used the first extension with that name. A certificate with a forged deprecated-OID extension ( TRUE) before its genuine extension ( FALSE) is accepted as a CA certificate, and the same technique can hide a . Fixed in node-forge 1.4.1. ### Details maps the deprecated certificate extension OIDs and to the nam

  2. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    node-forge fixed in 1.4.1

  3. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    node-forge fixed in 1.4.1

  4. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Summary node-forge parses certificate extensions with the deprecated OIDs and as , and used the first extension with that name. A certificate with a forged deprecated-OID extension ( TRUE) before its genuine extension ( FALSE) is accepted as a CA certificate, and the same technique can hide a . Fixed in node-forge 1.4.1. ### Details maps the deprecated certificate extension OIDs and to the nam

Sources

  • CVE.orgVulnerability recordCVE-2026-119190

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-5x38-2vff-x55p

    Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-119190

    node-forge parses certificate extensions with the deprecated OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and forge.pki.verifyCertificateChain() used the first extension with that name. A certificate with a forged deprecated-OID extension (cA TRUE) before its genuine basicConstraints extension (cA FALSE) is accepted as a CA certificate, and the same technique can hide a pathLenConstraint. Fix

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-5x38-2vff-x55p

    Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

    osv.dev

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseNov 6, 2026
  • GitLab Advisory DatabaseNov 3, 2026
  • CVE.orgOct 31, 2026
  • OpenSSF OSV / OSV ScannerOct 31, 2026