node-forge versions prior to 1.4.1 improperly handle deprecated X.509 certificate extension OIDs 2.5.29.10 and 2.5.29.13 by treating them as basicConstraints. This allows an attacker with a certificate containing a forged deprecated extension indicating CA privileges (cA TRUE) before the genuine basicConstraints extension (cA FALSE) to bypass CA validation checks. The vulnerability enables issuance of certificates accepted as CA certificates, potentially allowing impersonation in TLS connections. The issue is fixed in node-forge 1.4.1 by restricting verification to the standard basicConstraints OID 2.5.29.19.