PT-2026-28559 · Forge · Forge

Peaktwilight · Publicado 2026-03-26 · Atualizado 2026-05-18 · CVE-2026-33896

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.0

Description Forge, a native implementation of Transport Layer Security in JavaScript, has an issue where the pki.verifyCertificateChain() function does not properly enforce RFC 5280 basicConstraints requirements. Specifically, when an intermediate certificate is missing both the basicConstraints and keyUsage extensions, any leaf certificate can act as a Certificate Authority (CA) and sign other certificates, which Forge will incorrectly accept as valid. This bypass allows for the creation of untrusted certificate chains.

Recommendations Update to Forge version 1.4.0 or later.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CLEANSTART-2026-BE61221

CVE-2026-33896

GHSA-2328-F5F3-GJ25

Produtos afetados

Forge

Referências · 178

• 🔥 https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33896.json · Exploit
• https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90 · Correção
• https://github.com/digitalbazaar/forge · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BE61221.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4926 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-q5qw-h33p-qvwr · Nota
• https://osv.dev/vulnerability/CVE-2026-30827 · Nota
• https://osv.dev/vulnerability/CVE-2026-41238 · Nota
• https://osv.dev/vulnerability/ghsa-xhjh-pmcv-23jw · Nota
• https://osv.dev/vulnerability/CVE-2026-42034 · Nota
• https://osv.dev/vulnerability/ghsa-9vqf-7f2p-gf9v · Nota
• https://osv.dev/vulnerability/CVE-2026-44455 · Nota
• https://osv.dev/vulnerability/ghsa-pf86-5x62-jrwf · Nota
• https://osv.dev/vulnerability/CVE-2026-33891 · Nota