{"id":"CVE-2026-119189","aliases":["AZL-112463","EUVD-2026-113366","GHSA-h46v-rmh6-fq4f","UBUNTU-CVE-2026-119189"],"status":"published","title":"Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00171,"percentile":0.0654,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-10-29T19:23:25.238Z","modified":"2026-11-10T19:26:12Z","fixes":[{"ecosystem":"npm","package":"node-forge","fixed_in":["1.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.2-6"}]}]},{"source":"osv","ecosystem":"npm","package":"node-forge","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.5~dfsg-2","0.9.1~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0~dfsg-3","1.2.1~dfsg-2"]}],"products":[{"vendor":"digitalbazaar","product":"forge"}],"references":[{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-h46v-rmh6-fq4f","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/digitalbazaar/forge/commit/696db92348623e88cc63c35f0a89ede481d55ad0","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119189","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-h46v-rmh6-fq4f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119189.json","tags":["advisory"]},{"url":"https://github.com/digitalbazaar/forge","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-119189","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-119189","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-119189","title":"Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.","status":"published","published":"2026-10-29T19:23:25.238Z","modified":"2026-11-03T16:22:56.742Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-03T17:29:02.209656Z"}],"euvd":[{"id":"EUVD-2026-113366","description":"Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage","status":"published","published":"2026-11-10T15:57:43Z","modified":"2026-11-10T15:57:43Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-10T17:21:44.229469Z"}],"ghsa":[{"id":"GHSA-h46v-rmh6-fq4f","title":"Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage","description":"### Summary\n`forge.pki.verifyCertificateChain()` enforces the `pathLenConstraint` of a CA certificate's `basicConstraints` extension only when that certificate also has a `keyUsage` extension. For a CA certificate with a `pathLenConstraint` and no `keyUsage`, chains with more intermediate CA certificates below it than the constraint allows are accepted. Fixed in node-forge 1.4.1.\n\n### Details\nIn `pki.verifyCertificateChain()` (`lib/x509.js`), the path length check for a CA certificate was guarded by `keyUsageExt !== null \u0026\u0026 'pathLenConstraint' in bcExt`. The `keyUsage` test was originally a proxy for \"a basicConstraints extension exists\". Since node-forge 1.4.0 (GHSA-2328-f5f3-gj25), basicConstraints is required for every certificate that reaches this check, so the only remaining effect of the guard is to skip `pathLenConstraint` enforcement for CA certificates without `keyUsage`.\n\nRFC 5280 permits CA certificates without `keyUsage`, and path length processing in section 6.1.4 (l)-(m) does not depend on `keyUsage`; section 4.2.1.9 defines `pathLenConstraint` as part of basicConstraints only. For example, with a trusted root, an intermediate CA with `pathLenConstraint=0` and no `keyUsage`, a sub-CA issued by that intermediate, and a leaf issued by the sub-CA, node-forge accepts the chain. It correctly rejects the same chain when the intermediate has `keyUsage`.\n\nThe fix checks `pathLenConstraint` whenever the basicConstraints extension is present, regardless of `keyUsage` (based on PR #1142).\n\n#### Patches\nFixed in node-forge 1.4.1. `pathLenConstraint` is now enforced for CA certificates without a `keyUsage` extension.\n\n#### Workarounds\nNone in node-forge itself. Applications that pass an `options.verify` callback to `pki.verifyCertificateChain()` (or `verify` to `forge.tls.createConnection()`) can reject chains in which a CA certificate at `depth` d has `basicConstraints.pathLenConstraint \u003c d - 1`. Re-issuing constrained CA certificates with a `keyUsage` extension that includes `keyCertSign` also restores enforcement.\n\n#### References\n- RFC 5280, sections 4.2.1.9 and 6.1.4: https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4\n- Related: GHSA-2328-f5f3-gj25 / CVE-2026-33896 (basicConstraints bypass, fixed in 1.4.0)\n- https://github.com/digitalbazaar/forge/pull/1142\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (5.9, Moderate)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N (8.2)\nCVSS 4.0 weights the attack preconditions differently and scores this higher; the severity rating follows CVSS 3.1.\n\n#### Credits\n@offset, @eddieran, also reported independently by Zion Boggan (@zionboggan) and @EchoSkorJjj.\n\n### Proof of concept\nBuild the chain root \u003c- int \u003c- subCA \u003c- leaf, where `int` has basicConstraints `cA=true, pathLenConstraint=0` and no `keyUsage`, `subCA` is a CA certificate issued by `int`, and `leaf` is issued by `subCA`:\n\n```js\nvar caStore = forge.pki.createCaStore([root]);\nforge.pki.verifyCertificateChain(caStore, [leaf, subCA, int]);\n// \u003c= 1.4.0: true (pathLenConstraint=0 ignored)\n// 1.4.1: throws \"Certificate basicConstraints pathLenConstraint violated.\"\n```\n\nThe same chain is rejected on \u003c= 1.4.0 when `int` also has a `keyUsage` extension with `keyCertSign`. The fix adds regression tests in `tests/unit/x509.js` and the reporter's PoC as `tests/pocs/ghsa-h46v-rmh6-fq4f.js`.\n\n### Impact\nApplications that verify certificate chains with `forge.pki.verifyCertificateChain()`, including TLS peer certificate verification in `forge.tls`, are affected when a CA they trust (directly or through a chain) has a `pathLenConstraint` and no `keyUsage` extension.\n\nExploitation requires such a path-length-constrained CA certificate that chains to a root the application trusts. The attacker must either hold that CA's private key or obtain a CA certificate from it. That CA can then create subordinate CAs, and certificates issued by those subordinate CAs are accepted by `pki.verifyCertificateChain()`. Public web PKI CA certificates normally include `keyUsage`. Private PKIs whose CA certificates were created without `keyUsage` are most likely to be affected.","status":"published","published":"2026-11-10T15:57:43Z","modified":"2026-11-10T15:57:45Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-10T16:25:10.795148Z"}],"nvd":[{"id":"CVE-2026-119189","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.","status":"published","published":"2026-10-29T20:17:29.923Z","modified":"2026-11-10T19:26:12.787Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-10T22:21:30.732518Z"}],"osv":[{"id":"CVE-2026-119189","title":"Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.","status":"published","published":"2026-10-29T19:23:25.238Z","modified":"2026-11-12T02:46:34.620855016Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"GHSA-h46v-rmh6-fq4f","title":"Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage","description":"### Summary\n`forge.pki.verifyCertificateChain()` enforces the `pathLenConstraint` of a CA certificate's `basicConstraints` extension only when that certificate also has a `keyUsage` extension. For a CA certificate with a `pathLenConstraint` and no `keyUsage`, chains with more intermediate CA certificates below it than the constraint allows are accepted. Fixed in node-forge 1.4.1.\n\n### Details\nIn `pki.verifyCertificateChain()` (`lib/x509.js`), the path length check for a CA certificate was guarded by `keyUsageExt !== null \u0026\u0026 'pathLenConstraint' in bcExt`. The `keyUsage` test was originally a proxy for \"a basicConstraints extension exists\". Since node-forge 1.4.0 (GHSA-2328-f5f3-gj25), basicConstraints is required for every certificate that reaches this check, so the only remaining effect of the guard is to skip `pathLenConstraint` enforcement for CA certificates without `keyUsage`.\n\nRFC 5280 permits CA certificates without `keyUsage`, and path length processing in section 6.1.4 (l)-(m) does not depend on `keyUsage`; section 4.2.1.9 defines `pathLenConstraint` as part of basicConstraints only. For example, with a trusted root, an intermediate CA with `pathLenConstraint=0` and no `keyUsage`, a sub-CA issued by that intermediate, and a leaf issued by the sub-CA, node-forge accepts the chain. It correctly rejects the same chain when the intermediate has `keyUsage`.\n\nThe fix checks `pathLenConstraint` whenever the basicConstraints extension is present, regardless of `keyUsage` (based on PR #1142).\n\n#### Patches\nFixed in node-forge 1.4.1. `pathLenConstraint` is now enforced for CA certificates without a `keyUsage` extension.\n\n#### Workarounds\nNone in node-forge itself. Applications that pass an `options.verify` callback to `pki.verifyCertificateChain()` (or `verify` to `forge.tls.createConnection()`) can reject chains in which a CA certificate at `depth` d has `basicConstraints.pathLenConstraint \u003c d - 1`. Re-issuing constrained CA certificates with a `keyUsage` extension that includes `keyCertSign` also restores enforcement.\n\n#### References\n- RFC 5280, sections 4.2.1.9 and 6.1.4: https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4\n- Related: GHSA-2328-f5f3-gj25 / CVE-2026-33896 (basicConstraints bypass, fixed in 1.4.0)\n- https://github.com/digitalbazaar/forge/pull/1142\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (5.9, Moderate)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N (8.2)\nCVSS 4.0 weights the attack preconditions differently and scores this higher; the severity rating follows CVSS 3.1.\n\n#### Credits\n@offset, @eddieran, also reported independently by Zion Boggan (@zionboggan) and @EchoSkorJjj.\n\n### Proof of concept\nBuild the chain root \u003c- int \u003c- subCA \u003c- leaf, where `int` has basicConstraints `cA=true, pathLenConstraint=0` and no `keyUsage`, `subCA` is a CA certificate issued by `int`, and `leaf` is issued by `subCA`:\n\n```js\nvar caStore = forge.pki.createCaStore([root]);\nforge.pki.verifyCertificateChain(caStore, [leaf, subCA, int]);\n// \u003c= 1.4.0: true (pathLenConstraint=0 ignored)\n// 1.4.1: throws \"Certificate basicConstraints pathLenConstraint violated.\"\n```\n\nThe same chain is rejected on \u003c= 1.4.0 when `int` also has a `keyUsage` extension with `keyCertSign`. The fix adds regression tests in `tests/unit/x509.js` and the reporter's PoC as `tests/pocs/ghsa-h46v-rmh6-fq4f.js`.\n\n### Impact\nApplications that verify certificate chains with `forge.pki.verifyCertificateChain()`, including TLS peer certificate verification in `forge.tls`, are affected when a CA they trust (directly or through a chain) has a `pathLenConstraint` and no `keyUsage` extension.\n\nExploitation requires such a path-length-constrained CA certificate that chains to a root the application trusts. The attacker must either hold that CA's private key or obtain a CA certificate from it. That CA can then create subordinate CAs, and certificates issued by those subordinate CAs are accepted by `pki.verifyCertificateChain()`. Public web PKI CA certificates normally include `keyUsage`. Private PKIs whose CA certificates were created without `keyUsage` are most likely to be affected.","status":"published","published":"2026-11-10T15:57:43Z","modified":"2026-11-10T16:15:05.046196341Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-10T16:33:20.47232Z"},{"id":"UBUNTU-CVE-2026-119189","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.","status":"published","published":"2026-10-29T20:17:00Z","modified":"2026-11-05T04:42:51Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T13:33:25.727744Z"},{"id":"AZL-112463","title":"CVE-2026-119189 affecting package python-tensorboard 2.16.2-6","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.","status":"published","published":"2026-10-29T20:17:29Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:19.001909Z"}]}}