CVE-2026-125336: Forge: X.509 nameConstraints not enforced by verifyCertificateChain()
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validating certificate paths. A name-constrained certificate authority with a non-critical extension can therefore issue a leaf certificate with a subjectAltName dNSName or subject commonName outside a permitted subtree or inside an excluded subtree, and node-forge accepts the chain. Exploitation requires a name-constrained CA that chains to a trusted root and either its private key or the ability to obtain an out-of-scope certificate, allowing impersonation of names outside the delegated namespace, including against forge.tls clients. Chains without nameConstraints are not affected, and affected versions safely reject critical nameConstraints as unsupported rather than accepting them. This issue is fixed in version 1.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
Which deployments are actually exposed?
Deployments using Forge/node-forge versions prior to 1.4.3 are affected only when they validate a chain containing a CA with a non-critical X.509 nameConstraints extension. Chains without nameConstraints are not affected, and critical nameConstraints are safely rejected as unsupported.
What does an attacker need to exploit this issue?
An attacker needs a name-constrained CA that chains to a trusted root, plus either that CA's private key or the ability to obtain an out-of-scope certificate from it. They can then present a certificate for a name outside the permitted subtree or within an excluded subtree, enabling impersonation against clients such as forge.tls clients.
How can I remediate the issue?
Upgrade Forge/node-forge to version 1.4.3, which fixes the missing decoding and enforcement of nameConstraints during certificate-path validation.