Vulnerability · Published Feb 21, 2026 · Assigned by GitHub_M
CVE-2026-27452ASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBuffer
Critical 9.2
In plain English
A critical-severity information exposure in asn1-ts from JonathanWilbur. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.3%top 77.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER). In versions 11.0.5 and below, in some cases, decoding an INTEGER could leak the underlying ArrayBuffer. This issue is expected to be fixed in version 11.0.6.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| JonathanWilbur | asn1-ts | <= 11.0.5 |
Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N