Transport Layer Security Vulnerability in node-forge by Digital Bazaar

CVE-2026-119190

What is CVE-2026-119190?

The node-forge library, utilized for implementing Transport Layer Security in JavaScript, has a vulnerability related to the parsing of deprecated extension OIDs. Prior to version 1.4.1, it handled these extensions incorrectly, potentially allowing an attacker who controls a trusted Certificate Authority (CA) to craft a certificate with malicious extensions. This could lead to server or client impersonation, as the manipulated certificate could be erroneously accepted as valid. This issue has been addressed in the latest release.

References