CVE-2026-119189: Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Private PKIs are more likely to be affected, particularly where a CA certificate has a basicConstraints pathLenConstraint but no keyUsage extension. Public web PKI CA certificates normally include keyUsage.
What does an attacker need to exploit this issue?
The attacker needs a path-length-constrained CA without keyUsage that chains to a root trusted by the application. They must also hold that CA's private key or obtain a subordinate CA certificate from it.
What is the practical impact of successful exploitation?
An attacker can construct a certificate chain that exceeds the CA certificate's declared path length while still passing pki.verifyCertificateChain(). This can allow an unauthorized subordinate CA hierarchy to be accepted by the application.
What version contains the fix?
The issue is fixed in node-forge version 1.4.1.