CVE-2026-33896

CriticalCVSS 9.1/10Last modified Oct 26, 2026

Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

VendorProductVersions
digitalbazaarforge< 1.4.0
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—
Red HatCluster Observability Operator 1.5.0—
Red HatRed Hat Developer Hub 1.8—
Red HatRed Hat Developer Hub 1.9—
Red HatCryostat 4—
Red HatLogging Subsystem for Red Hat OpenShift—
Red HatLogging Subsystem for Red Hat OpenShift—
Red HatLogging Subsystem for Red Hat OpenShift—
Red HatLogging Subsystem for Red Hat OpenShift—
Red HatLogging Subsystem for Red Hat OpenShift—
Red HatLogging Subsystem for Red Hat OpenShift—
Red HatRed Hat Ansible Automation Platform 2—
Red HatRed Hat Ansible Automation Platform 2—
Red HatRed Hat build of Apache Camel - HawtIO 4—
Red HatRed Hat build of Apicurio Registry 2—
Red HatRed Hat Build of Podman Desktop—
Red HatRed Hat Build of Podman Desktop—
Red HatRed Hat Data Grid 8—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Fuse 7—
Red HatRed Hat Fuse 7—
Red HatRed Hat Process Automation 7—
Red HatRed Hat Quay 3—

References

Timeline

Published
Mar 27, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-338979.9Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary reaCVE-2026-338988.8Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validaCVE-2026-338995.3ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-189 and 6.9.13-44, whCVE-2026-33905.5A vulnerability was identified in FascinatedBox lily up to 2.3. This issue affects the function patch_line_end of the file src/lily_build_erCVE-2026-339007.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44CVE-2026-339017.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44CVE-2026-339025.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44CVE-2026-339036.5Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing a specially crafted NGAP LocationReport CVE-2026-339046.5Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the eCVE-2026-339057.1ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44CVE-2026-339067.2Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, the NetworkManager role was granted backup and restore permissCVE-2026-339076.5Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authenticati
CVE-2026-33896: Critical severity, CVSS 9.1 | Vulnix