Vulnerability · Published Nov 25, 2025 · Assigned by certcc
CVE-2025-12816CVE-2025-12816
High 8.6
In plain English
A high-severity security flaw in forge from Digital Bazaar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.6%top 52.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | node-node-forge | no fix listed | UBUNTU-CVE-2025-12816 |
| npm | node-forge | 1.3.2 | GHSA-5gfm-wpxj-wjgq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Digital Bazaar | node-forge | 0 – through 1.3.1 |
| Digital Bazaar | forge | 0 – through 1.3.1 |
Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N