Security readout for executives and security teams
Plain-English summary
Applications using node-forge before 1.4.0 may trust an invalid certificate chain. A certificate intended only as an endpoint could be treated as a certificate authority, enabling acceptance of certificates that should fail verification. This threatens the confidentiality and integrity of connections or identities relying on the affected verification function.
Executive priority
Treat as a high-priority patch for internet-facing or trust-sensitive applications using the affected function. Accelerate remediation where certificate validation controls authentication or confidential traffic. Systems carrying the library but not invoking this verification path can be prioritized after exposure is confirmed.
Technical view
Before 1.4.0, pki.verifyCertificateChain() fails to enforce RFC 5280 basicConstraints when an intermediate certificate lacks both basicConstraints and keyUsage. Consequently, a leaf certificate without those extensions can sign another certificate and have the chain accepted. The issue is classified as CWE-295 with CVSS 3.1 score 7.4.
Likely exposure
Exposure requires forge below 1.4.0 and use of pki.verifyCertificateChain() on certificate chains an attacker can influence. Merely having the package installed does not establish exploitability. Direct and transitive dependencies, bundled copies, and vendor-supplied packages should all be checked.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not listed as KEV. Network attack is possible without privileges or user interaction, but CVSS rates attack complexity high. Practical impact depends on whether affected verification protects sensitive communications, authentication, signing, or trust decisions.
Researcher notes
The vulnerable edge case requires an intermediate lacking both basicConstraints and keyUsage. Review call sites, trust-anchor handling, certificate provenance, and error paths. The supplied evidence identifies the validation flaw and patch version but does not demonstrate exploitation in the wild or quantify affected deployments.
Mitigation direction
- Upgrade forge or node-forge to version 1.4.0 or later.
- Identify and update transitive or bundled copies below version 1.4.0.
- Review applicable Red Hat advisories for vendor-packaged remediation.
- Prioritize systems where untrusted parties can influence certificate chains.
Validation and detection
- Confirm the resolved runtime version is 1.4.0 or later.
- Search dependency manifests, lockfiles, bundles, and deployed artifacts for older copies.
- Determine whether applications call pki.verifyCertificateChain() with externally influenced certificates.
- Test that chains using non-CA intermediates without required extensions are rejected.
- Verify vendor package updates against the applicable Red Hat advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-33896 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2GitHub_MCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-03-27T21:02:22.762Z: Reported to Red Hat.
- 2026-03-27T20:50:03.418Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-33896CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2452458CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33896.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:24761CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34342CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9742CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13826CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.