CVE-2025-12816

high

Description

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

References

https://www.kb.cert.org/vuls/id/521113

https://kb.cert.org/vuls/id/521113

https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-03

https://cert-portal.siemens.com/productcert/html/ssa-485750.html

https://www.bleepingcomputer.com/news/security/popular-forge-library-gets-fix-for-signature-verification-bypass-flaw/

https://github.com/slopfest/fedora-cve-triage

https://www.npmjs.com/package/node-forge

https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq

https://github.com/digitalbazaar/forge/pull/1124

https://github.com/digitalbazaar/forge

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199630

Details

Source: Mitre, NVD

Published: 2025-11-25

Updated: 2026-01-02

Named Vulnerability: GHSA-5gfm-wpxj-wjgq

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

Severity: High

CVSS v3

Base Score: 8.6

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00742