CVE-2026-33896
Full vulnerability record from the local CVENow database.
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Severity
CRITICAL
CVSS score
9.1
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-03-27 21:17:26.320000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-33896",
"sourceIdentifier": "[email protected]",
"published": "2026-03-27T21:17:26.320",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue."
},
{
"lang": "es",
"value": "Forge (también conocido como ’node-forge’) es una implementación nativa de Transport Layer Security en JavaScript. Antes de la versión 1.4.0, ’pki.verifyCertificateChain()’ no aplica los requisitos de basicConstraints de RFC 5280 cuando un certificado intermedio carece de las extensiones ’basicConstraints’ y ’keyUsage’. Esto permite que cualquier certificado hoja (sin estas extensiones) actúe como una CA y firme otros certificados, lo que node-forge aceptará como válidos. La versión 1.4.0 corrige el problema."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "digitalbazaar",
"product": "forge",
"versions": [
{
"version": "< 1.4.0",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "automation-gateway",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"versions": [
{
"version": "0:2.5.20260422-3.el8ap",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "automation-gateway",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"versions": [
{
"version": "0:2.5.20260422-3.el9ap",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cluster Observability Operator 1.5.0",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9",
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"versions": [
{
"version": "1782839279",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 1.8",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhdh/rhdh-hub-rhel9",
"cpes": [
"cpe:/a:redhat:rhdh:1.8::el9"
],
"versions": [
{
"version": "1776784286",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 1.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhdh/rhdh-hub-rhel9",
"cpes": [
"cpe:/a:redhat:rhdh:1.9::el9"
],
"versions": [
{
"version": "1777903262",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cryostat 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "io.cryostat-cryostat",
"cpes": [
"cpe:/a:redhat:cryostat:4"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch6-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-operator-bundle",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-proxy-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-rhel9-operator",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/kibana6-rhel8",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/logging-curator5-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "automation-eda-controller",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "automation-platform-ui",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Apache Camel - HawtIO 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "io.hawt-project",
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Apicurio Registry 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "io.apicurio-apicurio-registry",
"cpes": [
"cpe:/a:redhat:service_registry:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Podman Desktop",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "podman-desktop-macos-1-0",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Podman Desktop",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "podman-desktop-windows-1-0",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Data Grid 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "org.infinispan-infinispan-console",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "grafana",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "pcs",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "grafana",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "pcs",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Fuse 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "io.apicurio-apicurito",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Fuse 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "io.syndesis-syndesis-parent",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Process Automation 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "org.uberfire-uberfire-parent",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Quay 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quay/quay-rhel8",
"cpes": [
"cpe:/a:redhat:quay:3"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-03-30T18:53:46.442762Z",
"id": "CVE-2026-33896",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:*",
"versionEndIncluding": "1.3.3",
"matchCriteriaId": "46CBC667-ED99-4B5B-89C8-428CF52FD3FB"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13826",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:24761",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34342",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:9742",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-33896",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452458",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33896.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}