CVE-2026-119189: Schwachstellen-Eintrag (NVD)
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.
Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 743 | 0,2 % |
| ≥50 % | 3.224 | 0,8 % |
| ≥10 % | 22.065 | 5,8 % |
| <10 % | 354.697 | 93,2 % |
CVE-2026-119189 | Digitalbazaar Forge up to 1.4.0 pki.verifyCertificateChain certificate validation (Nessus ID 374242)
A vulnerability identified as problematic has been detected in Digitalbazaar Forge up to 1.4.0. This impacts the function pki.verifyCertificateChain. Performing a manipulation results in improper certificate validation. This vulnerability i