Answer in brief
CVE-2026-119189 records a Medium severity (CVSS 5.9) vulnerability in Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage. The current sources do not mark it as known exploited. The current feed maps digitalbazaar/forge (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps digitalbazaar/forge (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| digitalbazaar/forgegeneric | <1.4.1 | 1.4.1 |
Published upstream
Oct 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 29, 2026
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.
Quoted source text, attributed separately from HOL analysis.