Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-119189medium5.9

Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

Impact

Forge, a JavaScript TLS implementation, has a vulnerability in versions prior to 1.4.1 where X.509 pathLenConstraint is not enforced for CA certificates without keyUsage. An attacker with a private key or subordinate CA certificate could construct an excessive certificate chain. This issue is more likely to affect private PKIs with CA certificates created without keyUsage.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.
Applies when

Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

digitalbazaar · GitHub_M

forge

1 range
GitHub_M version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

< 1.4.1

unaffected

unknown

Other versions: unknown

Original source description

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-119189

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-295 ↗

CWE-295: Improper Certificate Validation

GitHub_M

Related →
Contributing organizations · 1
GitHub_M

Assigning organization

2026-10-29

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

3 sources
github.com/digitalbazaar/forge/security/advisories/GHSA-h46v-rmh6-fq4f
Security advisoryGitHub_M
github.com/digitalbazaar/forge/commit/696db92348623e88cc63c35f0a89ede481d55ad0
PatchGitHub_M
github.com/digitalbazaar/forge/releases/tag/v1.4.1
Release notesGitHub_M