Vulnerability in JavaScript TLS Implementation Affects Forge by Digital Bazaar
CVE-2026-33896

7.4HIGH

Key Information:

Vendor

Digitalbazaar

Status
Forge
Vendor
CVE Published:
27 March 2026

What is CVE-2026-33896?

The Forge library, a JavaScript implementation of Transport Layer Security, has a vulnerability in its certificate verification process. Specifically, versions prior to 1.4.0 allow intermediate certificates to bypass essential RFC 5280 constraints when they lack both the basicConstraints and keyUsage extensions. This loophole permits any such leaf certificate to act as a Certificate Authority (CA), potentially leading to unauthorized signing of other certificates by node-forge, which accepts them as valid. An update to version 1.4.0 addresses this security issue effectively.

Affected Version(s)

forge < 1.4.0

References

https://github.com/digitalbazaar/forge/security/advisorie...
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/commit/2e492832fb2...
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.