node-forge: Certificate validation bypass via deprecated extensions (CVE-2026-119190)
Prior to version 1.4.1, node-forge incorrectly parses deprecated certificate extensions, potentially allowing a certificate to be accepted as a CA and enabling impersonation.
CVE search metadata
CVE search record: CVE-2026-119190. Severity: high. CVSS: 7.4. KEV: no. Product: node-forge (< 1.4.1). Brief: node-forge: Certificate validation bypass via deprecated extensions (CVE-2026-119190). Brief link: https://feed.craftedsignal.io/briefs/2026-10-node-forge-cert-bypass/
Triage facts
Revision 1- Applicability
- node-forge (< 1.4.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 21:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
node-forge versions prior to 1.4.1 parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, with pki.verifyCertificateChain() prioritizing the first extension encountered. If a trusted CA issues a certificate containing these attacker-supplied extensions, the certificate may be accepted as a CA. This allows for server or client impersonation. If the CA includes a keyUsage extension without keyCertSign, the chain is rejected. This issue is addressed in version 1.4.1.