CVE-2026-119189

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...

CVE-2026-119189 Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...

CVE-2026-119189

The node-forge (Forge) JavaScript library, prior to version 1.4.1 , fails to enforce the X.509 pathLenConstraint for CA certificates that do not include a keyUsage extension. This vulnerability in the pki.verifyCertificateChain() function allows an attacker who possesses a path-length-constrained...

CVE-2026-119189 Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...

PT-2026-132809

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a...

HSEC-2023-0006 x509-validation does not enforce pathLenConstraint

x509-validation does not enforce pathLenConstraint x509-validation prior to version 1.4.8 did not enforce the pathLenConstraint value. Constrained CAs could accidentally or deliberately issue CAs below the maximum depth and x509-validation would accept certificates issued by the unauthorised...

PT-2023-35498

Name of the Vulnerable Software and Affected Versions x509-validation versions prior to 1.4.8 Description The issue concerns the failure to enforce the pathLenConstraint value, allowing constrained CAs to potentially issue certificates below the maximum depth. This could lead to the acceptance of...