CVE-2026-119189

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.

• CWE-295

• https://github.com/digitalbazaar/forge/commit/696db92348623e88cc63c35f0a89ede481d55ad0
• https://github.com/digitalbazaar/forge/releases/tag/v1.4.1
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-h46v-rmh6-fq4f

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11917A path traversal security issue exists within Rockwell Autom…7.2
• CVE-2026-119176The CP Multi View Events Calendar plugin for WordPress is vu…6.4
• CVE-2026-11918IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge…5.4
• CVE-2026-119186Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-119187Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-119188Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-119190Forge (also called node-forge) is a native implementation of…7.4
• CVE-2026-119191Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-119193PHPUnit is a testing framework for PHP. From 13.4.0 until 13…5.4
• CVE-2026-119194pyasn1 is a generic ASN.1 library for Python. From 0.3.3 unt…7.5
• CVE-2026-119195pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5…7.5
• CVE-2026-119196pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5…7.5