Mittel 5.9Linux-Server
CVE-2026-119189
node-forge: node-forge: Certificate validation bypass via unenforced path length constraints
node-forge
### Summary `forge.pki.verifyCertificateChain()` enforces the `pathLenConstraint` of a CA certificate's `basicConstraints` extension only when that certificate also has a `keyUsage` extension. For a CA certificate with a `pathLenConstraint` and no `keyUsage`, chains with more intermediate CA certificates below it than the constraint allows are accepted. Fixed in node-forge 1.4.1. ### Details In `pki.verifyCertificateChain()` (`lib/x509.js`), the path length check for a CA…
29. Okt 2026
Original bei Red Hat öffnen