CVE-2026-33896

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.

• CWE-295
• CWE-295

• https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90Patch
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25Exploit, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:13826
• https://access.redhat.com/errata/RHSA-2026:24761
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:9742
• https://access.redhat.com/security/cve/CVE-2026-33896
• https://bugzilla.redhat.com/show_bug.cgi?id=2452458
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25Exploit, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33896.json

Published

Mar 27, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33890MyTube is a self-hosted downloader and player for several vi…9.8
• CVE-2026-33891Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2026-33892A vulnerability has been identified in Industrial Edge Manag…7.1
• CVE-2026-33893A vulnerability has been identified in Teamcenter V2312 (All…8.7
• CVE-2026-33894Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2026-33895Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2026-33897Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-33898Incus is a system container and virtual machine manager. Pri…8.8
• CVE-2026-33899ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-3390A vulnerability was identified in FascinatedBox lily up to 2…5.5
• CVE-2026-33900ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-33901ImageMagick is free and open-source software used for editin…7.5