Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-27 | 1 | Disclosure1 |
| 2026-03-28 | 1 | General1 |
CVE-2026-33896 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not… https://www.cve.org/CVERecord?id=CVE-2026-33896
Post summary
The post briefly mentions CVE-2026-33896 affecting node-forge before version 1.4.0, but provides no actionable details or evidence of exploitation.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33896 - Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) Intel Report: https://ift.tt/qfp1x9S
Post summary
CVE‑2026‑33896 is disclosed as a basicConstraints bypass in Forge's certificate chain verification, a violation of RFC 5280, with no PoC, exploit, or patch mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | digitalbazaar | forge | - | node.js | - |