PT-2025-48075 · Unknown+1 · Node-Forge+1

Wodzen · Published 2025-11-25 · Updated 2026-04-01 · CVE-2025-12816

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions node-forge versions 1.3.1 and earlier

Description An interpretation-conflict issue exists in node-forge. Unauthenticated attackers can create specific ASN.1 structures that disrupt schema validations. This can lead to a difference in how data is understood, potentially bypassing cryptographic checks and security measures.

Recommendations Update node-forge to a version later than 1.3.1.

Fix

Weakness Enumeration

CWE-670

CWE-436

Related Identifiers

BDU:2025-15402

CVE-2025-12816

GHSA-5GFM-WPXJ-WJGQ

OPENSUSE-SU-2026:20177-1

SUSE-SU-2026:0628-1

SUSE-SU-2026:0630-1

SUSE-SU-2026:1008-1

SUSE-SU-2026:1013-1

SUSE-SU-2026:1035-1

SUSE-SU-2026:20232-1

Affected Products

Debian

Node-Forge

References · 93

• https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq · Vendor Advisory
• https://github.com/digitalbazaar/forge/pull/1124 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-12816 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20177-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-12816 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12816 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1013-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15402 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0628-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5gfm-wpxj-wjgq · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0630-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1008-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20232-1 · Vendor Advisory
• https://github.com/digitalbazaar/forge · Note
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328 · Note