Technical impact
Forge is a JavaScript implementation of TLS used in Node.js environments. In all releases earlier than 1.4.0, the certificate chain validation routine does not enforce RFC 5280 basicConstraints or keyUsage extensions when an intermediate certificate lacks these extensions. This flaw permits a leaf certificate that omits the required extensions to act as a certificate authority and sign other certificates, which node-forge will accept as valid. Consequently, an attacker could generate and deploy forged certificates that a host application trusting node-forge would accept, enabling impersonation of trusted servers and compromising confidentiality and integrity.
Affected Systems
The affected product is node-forge (also known as Forge) from DigitalBazaar. Versions preceding 1.4.0 are vulnerable; all earlier releases permit the described certificate chain bypass.
Risk and Exploitability
The CVSS base score is 7.4, indicating high severity, while the EPSS score is below 1 %, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitability is likely limited to contexts where an attacker can influence the certificates presented to node-forge, such as in applications that perform TLS with third‑party certificates or in supply‑chain scenarios. An attacker would need to craft a leaf certificate lacking basicConstraints and keyUsage, use it as a CA, sign a target certificate, and supply the resulting chain to an application that relies on node-forge for certificate verification.
Github GHSA