Zero Radar
← feed
HighVulnerabilityCVE-2026-119190updated 30 Oct 2026, 23:02 UTC

node-forge can accept a fake CA certificate, letting attackers impersonate websites

A flaw in the node-forge JavaScript library can make it trust a certificate that should not be trusted as a certificate authority. A holder of such a certificate could then create fake certificates for any website, which can fool apps into

Fixed in node-forge 1.4.1 · out Official, 2 sources
SeverityHighCVSS 7.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesnode-forge 1.4.1 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Obtains certificateAttacker gets a certificate from a trusted CA
  2. 2Forges extensionDeprecated OID marks the certificate as a CA
  3. 3Verification passesnode-forge reads the forged CA flag first
  4. 4ImpersonationAttacker signs certificates for any name
  5. ResultAttacker impersonates servers or clients

What happened

node-forge parses deprecated certificate extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() uses the first extension with that name, so a forged cA TRUE extension placed before the genuine basicConstraints extension is accepted as a CA.

Why it is dangerous: A certificate holder can issue certificates for arbitrary names, enabling server or client impersonation. Exploitation requires a CA the application trusts to issue a certificate with an attacker-supplied deprecated-OID extension, commonly when the CA copies extensions from a certificate signing request.

Are you affected?

You are affected if your application uses node-forge version 1.4.0 or earlier to verify certificate chains (pki.verifyCertificateChain() or forge.tls.createConnection()).

Package / productAffected versionsFixed in
node-forge · npm<= 1.4.01.4.1

What to do

  1. Update node-forge to version 1.4.1 or later
  2. If you cannot update yet, add a check in any verify callback that requires a non-leaf certificate to have a 2.5.29.19 basicConstraints extension with cA TRUE
  3. Ask certificate authorities you rely on not to copy unrecognized extensions from certificate requests

Timeline

  1. 29 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 20:21 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:02 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 23:02 UTC
    Fixed version published: node-forge 1.4.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119190 · GHSA-5x38-2vff-x55p
CVSS
7.4 / 10
Disclosed
29 Oct 2026, 20:17 UTC
On Zero Radar
29 Oct 2026, 20:21 UTC (4 min after disclosure)
Last change
30 Oct 2026, 23:02 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

node-forge can accept a fake CA certificate, letting attackers impersonate websites · Zero Radar