CVE-2026-33896 is a certificate validation flaw in node-forge, the JavaScript TLS and crypto library. NVD scores it 7.4. Before 1.4.0, pki.verifyCertificateChain() skipped CA checks for intermediates lacking certain extensions. Upgrade to 1.4.0. It matters most where your code verifies certificate chains itself.
What's affected
The advisory lists node-forge 1.3.3 and below as affected and 1.4.0 as patched. The flaw: when an intermediate certificate has neither basicConstraints nor keyUsage extensions, both CA authorization checks are skipped, so any leaf certificate without those extensions could sign others and be accepted. RFC 5280 requires the check. Red Hat errata are also linked.
Exposure applies to code that calls verifyCertificateChain itself.
How to check if you're exposed
npm ls node-forge
This shows every copy including transitive ones. Then search for verifyCertificateChain in your code and in dependencies that call it.
What to do now
- Upgrade node-forge to 1.4.0 or later, using overrides for transitive copies.
- Prefer the platform's TLS validation where possible.
- Rebuild and redeploy.
- Pin certificates for critical peers.
Why it matters
The record uses CWE-295, improper certificate validation. Trust in a chain depends on each link being allowed to sign. Skipping that check lets an attacker with any valid leaf mint certificates. The record is not marked as exploited in the wild and is not in CISA KEV.
A quick way to see why this is serious is to remember what a chain check is for. It answers whether a certificate was issued by someone allowed to issue it. If any leaf can pass as an issuer, the answer is always yes for an attacker holding one valid leaf. After you upgrade, add a test with a chain whose intermediate lacks the extensions and confirm validation fails. Where you can, use the platform TLS stack for validation instead of a JavaScript implementation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why check transitive copies?
node-forge is often pulled in by other packages, so your top level list may not show it.
Sources
Last reviewed: 19 October 2026.
