PT-2026-28559 · Forge · Forge

Peaktwilight · Published 2026-03-26 · Updated 2026-04-01 · CVE-2026-33896

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.0

Description Forge, a native implementation of Transport Layer Security in JavaScript, has an issue where the pki.verifyCertificateChain() function does not properly enforce RFC 5280 basicConstraints requirements. Specifically, when an intermediate certificate is missing both the basicConstraints and keyUsage extensions, any leaf certificate can act as a Certificate Authority (CA) and sign other certificates, which Forge will incorrectly accept as valid. This bypass allows for the creation of untrusted certificate chains.

Recommendations Update to Forge version 1.4.0 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-33896

GHSA-2328-F5F3-GJ25

Affected Products

Forge

References · 15

• 🔥 https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33896.json · Exploit
• https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90 · Patch
• https://osv.dev/vulnerability/CVE-2026-33896 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33896 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33896 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-33896 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2328-f5f3-gj25 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33896 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33896 · Vendor Advisory
• https://github.com/digitalbazaar/forge · Note
• https://reddit.com/r/VulnMatter/comments/1s55ox2/resumen_diario_de_vulnerabilidades_27032026 · Reddit Post
• https://twitter.com/CVEnew/status/2037719382122782745 · Twitter Post
• https://twitter.com/cyberbivash/status/2037641038924275902 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s5634y/resumen_diario_de_vulnerabilidades_27032026 · Reddit Post