The x509-validation library versions from 1.4.0 up to but not including 1.4.8 do not enforce the pathLenConstraint in X.509 certificates. This flaw allows constrained Certificate Authorities (CAs) to issue subordinate CAs beyond the allowed maximum depth, and x509-validation would accept certificates issued by these unauthorized intermediate CAs. The issue was fixed in version 1.4.8.