CVE-2026-119190: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications using node-forge versions before 1.4.1 are exposed when they trust a CA that can issue certificates containing an attacker-supplied deprecated extension OID, often because the CA copies extensions from certificate signing requests.
What does an attacker need to exploit this issue?
The attacker needs a certificate issued by a CA trusted by the application and must be able to get a permissive extension using OID 2.5.29.10 or 2.5.29.13 placed before the genuine basicConstraints extension (OID 2.5.29.19). They can then use that certificate as a CA to issue certificates for arbitrary names.
Are certificates protected if the issuing CA sets keyUsage restrictions?
Yes, node-forge rejects the chain if the issuing CA adds a keyUsage extension that does not include keyCertSign. This restriction prevents the described chain-validation bypass.
What should be done if immediate patching is not possible?
Ensure trusted issuing CAs do not copy attacker-controlled certificate-request extensions into issued certificates, and require keyUsage restrictions that omit keyCertSign where appropriate. Upgrade to node-forge 1.4.1 when possible.