x509-validation does not enforce pathLenConstraint
Affects x509-validationSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.4.8
Data as of 13 Nov 2026, 18:40 UTC
What to do
Upgrade x509-validation to 1.4.8.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagex509-validation | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade x509-validation to version 1.4.8 or later, where the pathLenConstraint enforcement is implemented. No other mitigation is required as the issue is resolved in this fixed version.
Description
The x509-validation library versions from 1.4.0 up to but not including 1.4.8 do not enforce the pathLenConstraint in X.509 certificates. This flaw allows constrained Certificate Authorities (CAs) to issue subordinate CAs beyond the allowed maximum depth, and x509-validation would accept certificates issued by these unauthorized intermediate CAs. The issue was fixed in version 1.4.8.