# Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

node-forge's verifyCertificateChain skips CA checks when an intermediate lacks both basicConstraints and keyUsage, letting any leaf cert sign certs for any domain.

- Payout: Research
- Severity: high
- Program: node-forge
- Found by: peaktwilight
- Disclosed: 2026-03-26
- CVE: CVE-2026-33896
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-2328-f5f3-gj25
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-2328-f5f3-gj25
- Tags: area:oss domain:oss impact:integrity kind:research platform:ghsa sev:high tech:nodejs technique:incomplete-fix technique:source-review vuln:auth-bypass vuln:crypto

**Target:** pki.verifyCertificateChain() in lib/x509.js
**Root cause:** Both CA-authorization checks are gated on extension presence: the keyUsage check on `keyUsageExt !== null` and the cA check on `bcExt !== null`. A cert with neither extension skips both, so absence of basicConstraints is treated as acceptance rather than rejection per RFC 5280 6.1.4(k).
**Steps:**
1. Generate a root CA with `basicConstraints cA:true` and `keyUsage keyCertSign` and self-sign it.
2. Create a leaf cert signed by root with NO basicConstraints and NO keyUsage extensions.
3. Create a victim cert for `victim.example.com` signed by the leaf's private key.
4. Call `pki.verifyCertificateChain(pki.createCaStore([rootCert]), [victimCert, leafCert])`.
5. Verification succeeds, accepting the non-CA leaf as an intermediate CA.
**How found:** Code review of verifyCertificateChain's conditional CA checks revealed both were gated on extension presence, so a cert with neither extension bypasses all CA validation; PoC confirmed no-extension cert accepted while cA=false and keyUsage-without-keyCertSign were rejected.
**Exploitation:** An attacker holding any valid leaf certificate lacking basicConstraints and keyUsage (e.g. a normal TLS cert for attacker.com) signs certificates for arbitrary domains; any app using node-forge verifyCertificateChain accepts the forged chain, enabling impersonation in custom PKI, S/MIME/PKCS#7 verification, and IoT cert validation.
**Insight:** When auditing chain verification, look for CA-authorization checks gated on extension presence (`!== null`) rather than requiring the extension; test certs with the extension entirely absent, not just set to false, since absence often falls through both branches.