High severity7.4NVD Advisory· Published Mar 27, 2026· Updated Apr 14, 2026
CVE-2026-33896
CVE-2026-33896
Description
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
node-forgenpm | < 1.4.0 | 1.4.0 |
Affected products
31- osv-coords30 versionspkg:apk/chainguard/kibana-7pkg:apk/chainguard/kibana-8.17pkg:apk/chainguard/kibana-8.17-bitnamipkg:apk/chainguard/kibana-8.17-iamguardedpkg:apk/chainguard/kibana-8.18pkg:apk/chainguard/kibana-8.18-bitnamipkg:apk/chainguard/kibana-8.18-iamguardedpkg:apk/chainguard/kibana-8.19pkg:apk/chainguard/kibana-8.19-bitnamipkg:apk/chainguard/kibana-8.19-iamguardedpkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kibana-9.3pkg:apk/chainguard/kibana-9.3-iamguardedpkg:apk/chainguard/kubeflow-centraldashboardpkg:apk/chainguard/kubeflow-pipelines-frontendpkg:apk/chainguard/opensearch-dashboards-2pkg:apk/chainguard/opensearch-dashboards-2-fipspkg:apk/chainguard/opensearch-dashboards-3pkg:apk/chainguard/wazuh-dashboardpkg:apk/wolfi/kubeflow-centraldashboardpkg:apk/wolfi/kubeflow-pipelines-frontendpkg:apk/wolfi/opensearch-dashboards-2pkg:apk/wolfi/opensearch-dashboards-3pkg:npm/node-forge
< 7.17.29-r8+ 29 more
- (no CPE)range: < 7.17.29-r8
- (no CPE)range: < 8.17.10-r15
- (no CPE)range: < 8.17.10-r15
- (no CPE)range: < 8.17.10-r15
- (no CPE)range: < 8.18.8-r11
- (no CPE)range: < 8.18.8-r11
- (no CPE)range: < 8.18.8-r11
- (no CPE)range: < 8.19.14-r2
- (no CPE)range: < 8.19.14-r2
- (no CPE)range: < 8.19.14-r2
- (no CPE)range: < 9.0.8-r16
- (no CPE)range: < 9.0.8-r16
- (no CPE)range: < 9.0.8-r16
- (no CPE)range: < 9.1.10-r12
- (no CPE)range: < 9.1.10-r12
- (no CPE)range: < 9.2.7-r5
- (no CPE)range: < 9.2.7-r5
- (no CPE)range: < 9.3.3-r4
- (no CPE)range: < 9.3.3-r4
- (no CPE)range: < 1.10.0-r18
- (no CPE)range: < 2.16.0-r11
- (no CPE)range: < 2.19.5-r6
- (no CPE)range: < 2.19.5-r5
- (no CPE)range: < 3.5.0-r11
- (no CPE)range: < 4.14.4-r1
- (no CPE)range: < 1.10.0-r18
- (no CPE)range: < 2.16.0-r11
- (no CPE)range: < 2.19.5-r6
- (no CPE)range: < 3.5.0-r11
- (no CPE)range: < 1.4.0
Patches
Vulnerability mechanics
References
4- github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90nvdPatchWEB
- github.com/advisories/GHSA-2328-f5f3-gj25ghsaADVISORY
- github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25nvdVendor AdvisoryExploitWEB
- nvd.nist.gov/vuln/detail/CVE-2026-33896ghsaADVISORY
News mentions
0No linked articles in our index yet.