CVE-2026-119189: Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage

November 10, 2026

forge.pki.verifyCertificateChain() enforces the pathLenConstraint of a CA certificate’s basicConstraints extension only when that certificate also has a keyUsage extension. For a CA certificate with a pathLenConstraint and no keyUsage, chains with more intermediate CA certificates below it than the constraint allows are accepted. Fixed in node-forge 1.4.1.

References

github.com/advisories/GHSA-h46v-rmh6-fq4f
github.com/digitalbazaar/forge/commit/696db92348623e88cc63c35f0a89ede481d55ad0
github.com/digitalbazaar/forge/releases/tag/v1.4.1
github.com/digitalbazaar/forge/security/advisories/GHSA-h46v-rmh6-fq4f
nvd.nist.gov/vuln/detail/CVE-2026-119189

Code Behaviors & Features

Detect and mitigate CVE-2026-119189 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →