Executive brief
node-forge is a JavaScript cryptography library used to validate certificate chains in custom PKI systems, S/MIME verification, and IoT applications. A flaw in its certificate chain verification allows a regular (non-CA) leaf certificate lacking basicConstraints and keyUsage extensions to be misidentified as a valid intermediate authority. An attacker possessing any standard leaf certificate can forge certificates for arbitrary domains, which applications relying on node-forge's verification will trust, leading to potential man-in-the-middle attacks, credential spoofing, and system compromise.
Technical details
The vulnerability exists in the `pki.verifyCertificateChain()` function in `lib/x509.js` (lines 3147–3199), which performs RFC 5280 certificate chain validation. The function contains two conditional checks for CA authorization: one guarded by `keyUsageExt !== null` and another by `bcExt !== null`. When an intermediate certificate lacks both extensions, both checks are skipped entirely, allowing the certificate to pass validation as a valid CA. RFC 5280 Section 6.1.4 step (k) explicitly requires that version 3 certificates have the basicConstraints extension present with cA set to TRUE; the absence should trigger rejection, not acceptance. An unauthenticated attacker with network access can exploit this by obtaining any valid leaf certificate and using it to sign forged end-entity certificates that will validate successfully in any application using node-forge for chain verification. The fix involves adding an explicit check: if `bcExt === null` on a non-leaf certificate, the validation should fail with a bad_certificate error. Patches are available in node-forge 1.4.0 and later.
Affected products
- Digital Bazaar node-forge <= 1.3.3
Timeline
- 2026-03-24: disclosed
- 2026-03-24: patched: Fixed in version 1.4.0 via commit 2e49283