CVE-2026-119189

Name of the Vulnerable Software and Affected Versions node-forge versions prior to 1.4.1

Description node-forge fails to properly enforce the basicConstraints.pathLenConstraint of an X.509 CA certificate unless the certificate also contains a keyUsage extension. An attacker possessing the private key of a path-length-constrained CA without keyUsage, or a subordinate CA certificate from it, could create a certificate chain that exceeds the declared path length but still passes the pki.verifyCertificateChain() function. This issue primarily affects private PKIs where CA certificates are created without the keyUsage extension.

Recommendations Update to version 1.4.1.