{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adigital_bazaarnode_forge/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:digital_bazaar:node_forge:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-119190"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["node-forge (\u003c 1.4.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Digital Bazaar"],"content_html":"\u003cp\u003enode-forge versions prior to 1.4.1 parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, with pki.verifyCertificateChain() prioritizing the first extension encountered. If a trusted CA issues a certificate containing these attacker-supplied extensions, the certificate may be accepted as a CA. This allows for server or client impersonation. If the CA includes a keyUsage extension without keyCertSign, the chain is rejected. This issue is addressed in version 1.4.1.\u003c/p\u003e\n","date_modified":"2026-10-31T03:20:28Z","date_published":"2026-10-29T21:10:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-node-forge-cert-bypass/","summary":"Prior to version 1.4.1, node-forge incorrectly parses deprecated certificate extensions, potentially allowing a certificate to be accepted as a CA and enabling impersonation.","title":"node-forge: Certificate validation bypass via deprecated extensions (CVE-2026-119190)","url":"https://feed.craftedsignal.io/briefs/2026-10-node-forge-cert-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:digital_bazaar:node_forge:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}