X.509 Certificate Path Validation Issue in Node-Forge by Digital Bazaar

CVE-2026-125336

What is CVE-2026-125336?

Node-Forge, a JavaScript library implementing Transport Layer Security, contains a vulnerability in its certificate validation mechanism. Specifically, prior to version 1.4.3, the function pki.verifyCertificateChain() fails to correctly decode the X.509 nameConstraints extension. This oversight allows a name-constrained certificate authority to issue leaf certificates with subject names that may violate the specified name constraints. As a result, attackers who control such a CA can impersonate entities outside a permitted namespace. The affected versions do not enforce the necessary checks, leading to potential security breaches. This issue has been resolved in version 1.4.3, which correctly handles nameConstraints, ensuring that any critical constraints are rejected.

References