MUT-BC-SS-01

MUT-BC-SS-01: Mutation Testing of X.509 BasicConstraints in OpenSSL Overview This repository implements a specification-driven mutation testing experiment targeting X.509 certificate validation behavior in OpenSSL. The experiment is based on the mutation operator: MUT-BC-SS-01 which modifies the...

npm: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

npm: Forge: X.509 basicConstraints bypass in verifyCertificateChain via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Summary node-forge parses certificate extensions with the deprecated OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and forge.pki.verifyCertificateChain used the first extension with that name. A certificate with a forged deprecated-OID extension cA TRUE before its genuine basicConstraints...

GHSA-5X38-2VFF-X55P Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Summary node-forge parses certificate extensions with the deprecated OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and forge.pki.verifyCertificateChain used the first extension with that name. A certificate with a forged deprecated-OID extension cA TRUE before its genuine basicConstraints...

EUVD-2026-113347

Forge: X.509 basicConstraints bypass in verifyCertificateChain via deprecated extension OIDs 2.5.29.10 and 2.5.29.13...

CVE-2026-119190

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

CVE-2026-119190

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

CVE-2026-119190 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

CVE-2026-119190 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

CVE-2026-119190

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

CVE-2026-119190

The Forge (node-forge) JavaScript TLS library versions prior to 1.4.1 contain a vulnerability in pki.verifyCertificateChain() where deprecated extension OIDs 2.5.29.10 and 2.5.29.13 are incorrectly parsed as basicConstraints . This oversight allows an attacker to bypass certificate constraints by...

CVE-2026-119190 Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

PT-2026-132810

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.1 Description Forge also known as node-forge incorrectly parses deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints. The pki.verifyCertificateChain function uses the first extension found with that...

CVE-2026-119190: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain used the first extension with that name. Exploitation requires...

Linux Distros Unpatched Vulnerability : CVE-2026-42789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an...

DEBIAN-CVE-2026-42789

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

AZL-89172 CVE-2026-42789 affecting package erlang for versions less than 26.2.5.21-1

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

UBUNTU-CVE-2026-42789

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

CVE-2026-42789 Non-CA certificate accepted as intermediate issuer in public_key path validation

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...

EUVD-2026-32272

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP publickey pubkeycert module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/publickey/src/pubkeycert.erl, pubkeycert:validateextensions/7 contains two...