CVE-2026-33896: CWE-295: Improper Certificate Validation in digitalbazaar forge
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
AI Analysis
Technical Summary
CVE-2026-33896 is an improper certificate validation vulnerability in the node-forge library, specifically in the pki.verifyCertificateChain() method. Prior to version 1.4.0, the method fails to enforce RFC 5280 basicConstraints requirements when intermediate certificates lack both basicConstraints and keyUsage extensions. This allows any leaf certificate missing these extensions to be treated as a CA and sign other certificates, which node-forge will accept as valid, effectively enabling unauthorized certificate issuance. The vulnerability has a CVSS 3.1 base score of 7.4 (High) with network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required. Version 1.4.0 of node-forge addresses this issue.
Potential Impact
An attacker can exploit this vulnerability to bypass certificate validation by using a leaf certificate without basicConstraints and keyUsage extensions to act as a CA and issue unauthorized certificates. This can lead to acceptance of forged certificates by applications relying on node-forge for TLS certificate validation, potentially compromising confidentiality and integrity of communications.
Mitigation Recommendations
A fix is available in node-forge version 1.4.0. Users and organizations should upgrade to version 1.4.0 or later to remediate this vulnerability. The vendor advisory from Red Hat confirms the issue and the availability of patches in their affected products. No additional mitigation steps are indicated beyond applying the official fix.
CVE-2026-33896: CWE-295: Improper Certificate Validation in digitalbazaar forge
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
CVSS v3.1
Score 7.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-33896 is an improper certificate validation vulnerability in the node-forge library, specifically in the pki.verifyCertificateChain() method. Prior to version 1.4.0, the method fails to enforce RFC 5280 basicConstraints requirements when intermediate certificates lack both basicConstraints and keyUsage extensions. This allows any leaf certificate missing these extensions to be treated as a CA and sign other certificates, which node-forge will accept as valid, effectively enabling unauthorized certificate issuance. The vulnerability has a CVSS 3.1 base score of 7.4 (High) with network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required. Version 1.4.0 of node-forge addresses this issue.
Potential Impact
An attacker can exploit this vulnerability to bypass certificate validation by using a leaf certificate without basicConstraints and keyUsage extensions to act as a CA and issue unauthorized certificates. This can lead to acceptance of forged certificates by applications relying on node-forge for TLS certificate validation, potentially compromising confidentiality and integrity of communications.
Mitigation Recommendations
A fix is available in node-forge version 1.4.0. Users and organizations should upgrade to version 1.4.0 or later to remediate this vulnerability. The vendor advisory from Red Hat confirms the issue and the availability of patches in their affected products. No additional mitigation steps are indicated beyond applying the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-24T15:41:47.490Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-33896","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24761","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","vendor":"Red Hat"}]
Threat ID: 69c6efd03c064ed76ff473f9
Added to database: 03/27/2026, 21:00:00 UTC
Last enriched: 07/15/2026, 13:22:12 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 165
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.