Transport Layer Security Vulnerability in Node-Forge by Digital Bazaar

CVE-2026-119189

What is CVE-2026-119189?

The node-forge JavaScript library had a vulnerability that affected how it enforced basicConstraints.pathLenConstraint for X.509 CA certificates. Prior to version 1.4.1, the library only validated this constraint if the certificate carried a keyUsage extension. Attackers leveraging this flaw could exploit path-length-constrained CA certificates that do not have the keyUsage extension, constructing a certificate chain that exceeds the declared path length without triggering expected validation failures. This vulnerability primarily impacts private PKIs where CA certificates may be created without keyUsage, exposing applications to potential certificate chain exploitation.

References