Skip to content
fr Sign in
7.4 High

CVE-2026-33896 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript

Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.

Affected products and versions

Product Affected versions Fixed in
forge 1.4 earliest → < 1.4.0 1.4.0
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Developer Hub 1.8 1776784286 earliest → < 1776784286 1776784286
Red Hat Developer Hub 1.9 1777903262 earliest → < 1777903262 1777903262
Logging Subsystem for Red Hat OpenShift Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat Build of Podman Desktop Versions not published
Red Hat Data Grid 8 Versions not published
Show the 10 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Quay 3 Versions not published
Cryostat 4 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Process Automation 7 Versions not published
Cluster Observability Operator 1.5.0 1782839279 earliest → < 1782839279 1782839279

References

Timeline

  1. Published
  2. Last modified

Other CVEs of forge

The 25 CVEs of forge →
CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer 7.5 High CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.4 High CVE-2026-119189 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 5.9 Medium CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript 7.5 High
Track this CVE