CVE-2026-119189

The record

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.

Affected packages

Related vulnerabilities

• CVE-2026-118697 In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and… CWE-295
• CVE-2026-112816 Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10… CWE-295
• CVE-2026-119559 OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows… CWE-295
• CVE-2026-92744 Under certain conditions, privilege manager agent allows a remote unauthenticated… CWE-295
• CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-295
• CVE-2026-118780 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-295
• CVE-2026-119118 Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that… CWE-295
• CVE-2026-106036 Szafir accepts any client or server certificate without performing certificate and… CWE-295