A critical certificate validation flaw in the node-forge library allows attackers to forge valid certificate chains, potentially leading to unauthorized data interception.

This vulnerability occurs because the pki.verifyCertificateChain function fails to enforce RFC 5280 basicConstraints requirements when intermediate certificates lack specific extensions. An unauthenticated attacker can leverage this to present a malicious leaf certificate that is accepted as a trusted Certificate Authority.

The vulnerability carries a CVSS score of 7.4, indicating high severity due to the potential for complete compromise of encrypted communication integrity. If exploited, an attacker could conduct man-in-the-middle attacks to intercept, read, or modify sensitive data protected by TLS, leading to significant privacy breaches and loss of trust in secure communications.

Immediate Action: Update the node-forge dependency to version 1.4.0 or later immediately to enforce correct certificate chain validation.

Proactive Monitoring: Monitor application logs for unusual TLS handshake failures or connections involving unexpected certificate attributes.

Compensating Controls: Implement strict certificate pinning or secondary validation logic for high-value connections if immediate patching is not feasible.

Public Exploit Available: Unknown.

Given the high impact on cryptographic integrity, organizations using node-forge must prioritize upgrading to version 1.4.0. Failure to address this vulnerability exposes internal and external communications to interception and impersonation risks, which could have severe consequences for data confidentiality and system security.