CVE-2026-33896

Forge also called "node-forge" is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, "pki.verifyCertificateChain" does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the "basicConstraints" and "keyUsage"...

CVE-2026-33896: Improper Certificate Validation

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, pki.verifyCertificateChain does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions...