CVE-2026-119190

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1

Description Forge (also known as node-forge) incorrectly parses deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints. The pki.verifyCertificateChain() function uses the first extension found with that name. An attacker can exploit this if a trusted Certificate Authority (CA) issues a certificate containing a permissive deprecated extension before the legitimate 2.5.29.19 basicConstraints extension. This allows the certificate holder to be accepted as a CA and issue certificates for arbitrary names, leading to server or client impersonation. However, the chain is rejected if the issuing CA adds a keyUsage extension without keyCertSign.

Recommendations Update to version 1.4.1.