CVE-2026-125336

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validating certificate paths. A name-constrained certificate authority with a non-critical extension can therefore issue a leaf certificate with a subjectAltName dNSName or subject commonName outside a permitted subtree or inside an excluded subtree, and node-forge accepts the chain. Exploitation requires a name-constrained CA that chains to a trusted root and either its private key or the ability to obtain an out-of-scope certificate, allowing impersonation of names outside the delegated namespace, including against forge.tls clients. Chains without nameConstraints are not affected, and affected versions safely reject critical nameConstraints as unsupported rather than accepting them. This issue is fixed in version 1.4.3.

• CWE-295

• https://github.com/digitalbazaar/forge/commit/6b23eae8beac316b6867bdb0e7ad7c2c959a97f6
• https://github.com/digitalbazaar/forge/commit/862aa5f630bdf40b0dfda408d6ac357bf35a7d6b
• https://github.com/digitalbazaar/forge/pull/1169
• https://github.com/digitalbazaar/forge/releases/tag/v1.4.3
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-3cc4-3294-vgjf

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125330HarnessRouter is a self-hosted unified API for agent harness…7.5
• CVE-2026-125331HarnessRouter is a self-hosted unified API for running agent…9.1
• CVE-2026-125332Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-125333Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-125334Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-125335Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-125337Winter CMS is a content management system built on the Larav…8.3
• CVE-2026-125338Winter CMS is a content management system built on the Larav…4.5
• CVE-2026-125339Winter CMS is a content management system built on the Larav…6.1
• CVE-2026-125340Winter CMS is a content management system built on the Larav…4.5
• CVE-2026-125341Winter CMS is a content management system built on the Larav…2
• CVE-2026-125342Uninitialized resource in GPU in Google Chrome prior to 157.…4.7