{"action":"Upgrade node-forge to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"node-forge","cve_ids":["CVE-2026-33896"],"ecosystem":"npm","epss":0.005,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-2328-f5f3-gj25","id":"tcs_01M5KERQ7Y20ASSDVDXC72APQM","modified_at":"2026-09-10T03:50:36.185660437Z","published_at":"2026-03-26T22:05:43Z","references":["https://osv.dev/vulnerability/GHSA-2328-f5f3-gj25","https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25","https://nvd.nist.gov/vuln/detail/CVE-2026-33896","https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90","https://github.com/digitalbazaar/forge"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-2328-f5f3-gj25","url":"https://osv.dev/vulnerability/GHSA-2328-f5f3-gj25"}],"summary":"Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)"}