{"id":"EUVD-2026-113347","enisaUuid":"264d0a4c-94b1-3a76-bd5c-d09153bdcef5","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","datePublished":"Oct 29, 2026, 7:25:09 PM","dateUpdated":"Oct 29, 2026, 8:25:04 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p\nhttps://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.1\n","aliases":"CVE-2026-119190\nGHSA-5x38-2vff-x55p\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"a1263aee-c725-3887-af37-745c1fe7f52d","product":{"name":"forge","vendor":{"name":"digitalbazaar"}},"product_version":"\u003c 1.4.1"}],"enisaIdVendor":[{"id":"4bd3ec8b-0361-3604-9b1c-4de25c21fc7a","vendor":{"name":"digitalbazaar"}}],"enisaIdVulnerability":[{"id":"56a1a25b-de99-3394-9db5-cded552511f9","vulnerability":{"id":"GHSA-5x38-2vff-x55p","description":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","datePublished":"Oct 30, 2026, 11:01:46 PM","dateUpdated":"Oct 30, 2026, 11:01:46 PM","baseScore":0.0,"references":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119190\nhttps://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a\nhttps://github.com/digitalbazaar/forge\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.1\n","enisa_id":"EUVD-2026-113347\n","aliases":"CVE-2026-119190\nGHSA-5x38-2vff-x55p\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 7:03:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c77f6303-b109-3362-b647-408c8e02239e","vulnerability":{"id":"CVE-2026-119190","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.","datePublished":"Oct 29, 2026, 7:25:09 PM","dateUpdated":"Oct 29, 2026, 8:25:04 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p\nhttps://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a\nhttps://github.com/digitalbazaar/forge/releases/tag/v1.4.1\n","enisa_id":"EUVD-2026-113347\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Nov 5, 2026, 7:16:29 AM","vulnerabilityProduct":[{"id":"21f86df5-e3cf-35a2-b34e-3b4d5dcce293","product":{"name":"forge","vendor":{"name":"digitalbazaar"}},"product_version":"\u003c 1.4.1"}],"vulnerabilityVendor":[{"id":"8dbeaeae-ad2b-3610-ab6a-6465c4a00bb5","vendor":{"name":"digitalbazaar"}}]}}],"enisaIdAdvisory":[{"id":"32019eed-97fc-3067-8fc1-4ca57a2b6d77","advisory":{"id":"msrc_CVE-2026-119190","description":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","datePublished":"Nov 3, 2026, 1:02:33 AM","dateUpdated":"Nov 4, 2026, 1:45:31 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-119190.json\n","aliases":"CVE-2026-119190\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"46d734b2-b2ac-3f63-9db7-21dcfffabdab","product":{"name":"azl3 python-tensorboard 0:2.16.2-6.azl3","vendor":{"name":"Microsoft"}}},{"id":"5197437e-308f-3b04-a3be-5643d8a7bc83","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"9d44fa13-86c0-3f95-8d96-22ab22f7537f","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}}]}}]}