CVE-2026-33896: Digital Bazaar node-forge certificate validation bypass in verifyCertificateChain

CVE-2026-33896 · Severity: high · CVSS 7.4 · Published 2026-03-27

node-forge is a JavaScript cryptography library used to validate certificate chains in custom PKI systems, S/MIME verification, and IoT applications. A flaw in its certificate chain verification allows a regular (non-CA) leaf certificate lacking basicConstraints and keyUsage extensions to be misidentified as a valid intermediate authority. An attacker possessing any standard leaf certificate can forge certificates for arbitrary domains, which applications relying on node-forge's verification will trust, leading to potential man-in-the-middle attacks, credential spoofing, and system compromise.

Technologies: Digital Bazaar Forge, node-forge (npm), Red Hat build of Apicurio Registry, Red Hat Build of Podman Desktop, Red Hat Developer Hub. Vendors: Digital Bazaar, npm, Red Hat.

Quick answers

Is CVE-2026-33896 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33896 being exploited in the wild.
How severe is CVE-2026-33896?
High severity, with a CVSS score of 7.4, published 27 March 2026.
Which products and versions are affected?
Digital Bazaar Forge <= 1.3.3; node-forge (npm) SEMVER:introduced=0,fixed=1.4.0.
Is there a fix for CVE-2026-33896?
Yes. node-forge (npm): upgrade to 1.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33896 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33896?
Check whether you run Digital Bazaar Forge, node-forge (npm), Red Hat build of Apicurio Registry or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • node-forge (npm): upgrade to 1.4.0 or later
    npm install node-forge@1.4.0

Technical details

The vulnerability exists in the `pki.verifyCertificateChain()` function in `lib/x509.js` (lines 3147–3199), which performs RFC 5280 certificate chain validation. The function contains two conditional checks for CA authorization: one guarded by `keyUsageExt !== null` and another by `bcExt !== null`. When an intermediate certificate lacks both extensions, both checks are skipped entirely, allowing the certificate to pass validation as a valid CA. RFC 5280 Section 6.1.4 step (k) explicitly requires that version 3 certificates have the basicConstraints extension present with cA set to TRUE; the absence should trigger rejection, not acceptance. An unauthenticated attacker with network access can exploit this by obtaining any valid leaf certificate and using it to sign forged end-entity certificates that will validate successfully in any application using node-forge for chain verification. The fix involves adding an explicit check: if `bcExt === null` on a non-leaf certificate, the validation should fail with a bad_certificate error. Patches are available in node-forge 1.4.0 and later.

Affected products

  • Digital Bazaar node-forge <= 1.3.3

Identifiers

  • CVE-2026-33896
  • GHSA-2328-f5f3-gj25

Timeline

  • 2026-03-24: disclosed
  • 2026-03-24: patched: Fixed in version 1.4.0 via commit 2e49283

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.