Forge skips path length check for CA certificates without keyUsage
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 19 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295.
Summary
Forge (node-forge) before 1.4.1 enforces the pathLenConstraint of an X.509 CA certificate only when that certificate also has a keyUsage extension (CWE-295). An attacker who holds the private key of such a CA, or can obtain a subordinate CA certificate from it, can build a chain that exceeds the declared path length and still passes pki.verifyCertificateChain(). Private PKIs whose CA certificates lack keyUsage are more likely to be affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| digitalbazaar | forge | before 1.4.1 | 1.4.1 | Patch available | CNA |
- forge Vendordigitalbazaar Affected before 1.4.1 Fixed in 1.4.1 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* | — | — | digitalbazaar |
- cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:*:*:* Versions — — ·digitalbazaar
Remediation
Update digitalbazaar forge to version 1.4.1. The sources list no fixed version for Node HealthCheck Operator, OpenShift Service Mesh 3, Red Hat Ceph Storage 4, Red Hat Fuse 7, OpenShift Pipelines, OpenShift Serverless and other Red Hat products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA forge (digitalbazaar) Fixed in 1.4.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix planned: Out of support scope |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix planned: Out of support scope |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-29 Threatist record created from CVE-2026-119189
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
- 2026-10-31 Priority changed: MEDIUM → LOW
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: LOW → MEDIUM
References
More digitalbazaar vulnerabilities
- TI-2026-58601 node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding CVSS 4.0HIGH 8.7
- TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
- TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
- TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
- TI-2026-82733 Forge accepts zero iteration count, enabling PKCS#12 integrity bypass CVSS 3.1HIGH 7.5
- TI-2026-82730 Regular expression denial of service in Forge PEM decoding CVSS 3.1HIGH 7.5
Sources
- CVE-2026-119189 · CVE Program
- CVE-2026-119189 · NVD
- FIRST EPSS
- CVE-2026-119189 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences