PT-2026-28559 · Forge · Forge

Peaktwilight · CVE-2026-33896 · Published 2026-03-26 · Updated 2026-07-02

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.0

Description Forge, a native implementation of Transport Layer Security in JavaScript, has an issue where the pki.verifyCertificateChain() function does not properly enforce RFC 5280 basicConstraints requirements. Specifically, when an intermediate certificate is missing both the basicConstraints and keyUsage extensions, any leaf certificate can act as a Certificate Authority (CA) and sign other certificates, which Forge will incorrectly accept as valid. This bypass allows for the creation of untrusted certificate chains.

Recommendations Update to Forge version 1.4.0 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CLEANSTART-2026-BE61221

CVE-2026-33896

GHSA-2328-F5F3-GJ25

RHSA-2026:24761

Affected Products

Forge

References · 186

• 🔥 https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33896.json · Exploit
• https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42033 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29085 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42040 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33896 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6321 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2950 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42037 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35213 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Security Note