Hoch 7.4Software
CVE-2026-125336
Forge: X.509 nameConstraints not enforced by verifyCertificateChain()
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validating certificate paths. A name-constrained certificate authority with a non-critical extension can therefore issue a leaf certificate with a subjectAltName dNSName or subject commonName outside a permitted subtree or inside an excluded…
10. Nov 2026
Original bei Microsoft öffnen