{"id":"EUVD-2026-113347","enisaUuid":"264d0a4c-94b1-3a76-bd5c-d09153bdcef5","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","datePublished":"Oct 29, 2026, 7:25:09 PM","dateUpdated":"Oct 29, 2026, 8:25:04 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p\nhttps://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.1\n","aliases":"CVE-2026-119190\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"a1263aee-c725-3887-af37-745c1fe7f52d","product":{"name":"forge","vendor":{"name":"digitalbazaar"}},"product_version":"\u003c 1.4.1"}],"enisaIdVendor":[{"id":"4bd3ec8b-0361-3604-9b1c-4de25c21fc7a","vendor":{"name":"digitalbazaar"}}],"enisaIdVulnerability":[{"id":"c77f6303-b109-3362-b647-408c8e02239e","vulnerability":{"id":"CVE-2026-119190","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","datePublished":"Oct 29, 2026, 7:25:09 PM","dateUpdated":"Oct 29, 2026, 8:25:04 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p\nhttps://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.1\n","enisa_id":"EUVD-2026-113347\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Oct 31, 2026, 1:01:06 AM","vulnerabilityProduct":[{"id":"21f86df5-e3cf-35a2-b34e-3b4d5dcce293","product":{"name":"forge","vendor":{"name":"digitalbazaar"}},"product_version":"\u003c 1.4.1"}],"vulnerabilityVendor":[{"id":"8dbeaeae-ad2b-3610-ab6a-6465c4a00bb5","vendor":{"name":"digitalbazaar"}}]}}],"enisaIdAdvisory":[]}