by Kastro CVE-2026-33896
digitalbazaar forge — Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Description · from the CVE record
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Affected
ProductAffectedFixed inSource
forge< 1.4.0–CNA
Red Hat Ansible Automation Platform 2.5 for RHEL 8see advisory0:2.5.20260422-3.el8apredhat-SADP
Red Hat Ansible Automation Platform 2.5 for RHEL 9see advisory0:2.5.20260422-3.el9apredhat-SADP
Cluster Observability Operator 1.5.0see advisory1782839279redhat-SADP
Red Hat Developer Hub 1.8see advisory1776784286redhat-SADP
Red Hat Developer Hub 1.9see advisory1777903262redhat-SADP
Cryostat 4see advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Logging Subsystem for Red Hat OpenShiftsee advisory–redhat-SADP
Scores by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
redhat-SADP (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total