# CVE-2025-12816: node-forge — Fixed in 1.3.2 📦 📦 npm Not in CISA KEV HIGH severity # CVE-2025-12816 — node-forge HIGH [Fix: digitalbazaar/forge#1124](https://github.com/digitalbazaar/forge/pull/1124) CVE-2025-12816 is a high-severity (CVSS 8.6) CWE-436 vulnerability in node-forge. A fix is available for node-forge — see the affected versions and patch details below. CVE-2025-12816 Also known as[GHSA-5gfm-wpxj-wjgq](/vulnerability/GHSA-5gfm-wpxj-wjgq) Published Nov 25, 2025 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-12816. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.6%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs48th percentile — riskier than 48% of all scored CVEsHighest risk 0.00%0.42%0.84%1.25%0.1%0.6%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched. 4Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream `node-forge`npm 55.2Mdownloads / week ## Description #### Summary CVE-2025-12816 has been reserved by CERT/CC **Description** An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions. #### Details A critical ASN.1 validation bypass vulnerability exists in the node-forge asn1.validate function within `forge/lib/asn1.js`. ASN.1 is a schema language that defines data structures, like the typed record schemas used in X.509, PKCS#7, PKCS#12, etc. DER (Distinguished Encoding Rules), a strict binary encoding of ASN.1, is what cryptographic code expects when verifying signatures, and the exact bytes and structure must match the schema used to compute and verify the signature. After deserializing DER, Forge uses static ASN.1 validation schemas to locate the signed data or public key, compute digests over the exact bytes required, and feed digest and signature fields into cryptographic primitives. This vulnerability allows a specially crafted ASN.1 object to desynchronize the validator on optional boundaries, causing a malformed optional field to be semantically reinterpreted as the subsequent mandatory structure. This manifests as logic bypasses in cryptographic algorithms and protocols with optional security features (such as PKCS#12, where MACs are treated as absent) and semantic interpretation conflicts in strict protocols (such as X.509, where fields are read as the wrong type). #### Impact This flaw allows an attacker to desynchronize the validator, allowing critical components like digital signatures or integrity checks to be skipped or validated against attacker-controlled data. This vulnerability impacts the `ans1.validate` function in `node-forge` before patched version `1.3.2`. [https://github.com/digitalbazaar/forge/blob/main/lib/asn1.js](https://github.com/digitalbazaar/forge/blob/main/lib/asn1.js). The following components in `node-forge` are impacted. [lib/asn1.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153) [lib/x509.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667) [lib/pkcs12.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328) [lib/pkcs7.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90) [lib/rsa.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167) [lib/pbe.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363) [lib/ed25519.js](https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81) Any downstream application using these components is impacted. These components may be leveraged by downstream applications in ways that enable full compromise of integrity, leading to potential availability and confidentiality compromises. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 📦npm `node-forge` all versions 1.3.2`npm install node-forge@1.3.2` ## Affected Products 1 product · 1 configurations Application `forge`digitalbazaar ≤ 1.3.1 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for node-forge, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update node-forge to 1.3.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-12816 is resolved across your whole dependency graph. 3. ### Workarounds Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatImportant This vulnerability is rated Important for Red Hat products due to an interpretation conflict in the node-forge library. An unauthenticated attacker could exploit this flaw by crafting malicious ASN.1 structures, leading to a bypass of cryptographic verifications and security decisions in affected applications. This… Workaround published by Red Hat > Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Source: [Red Hat security advisory for CVE-2025-12816](https://access.redhat.com/security/cve/cve-2025-12816) (CC BY 4.0) Product Fixed in Advisory Migration Toolkit for Virtualization 2.9 `migration-toolkit-virtualization/mtv-console-plugin-rhel9:1769034026` [RHSA-2026:1248](https://access.redhat.com/errata/RHSA-2026:1248) Multicluster Global Hub 1.4.9 `multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1770126537` [RHSA-2026:2500](https://access.redhat.com/errata/RHSA-2026:2500) Multicluster Global Hub 1.5.8 `multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1770109405` [RHSA-2026:2256](https://access.redhat.com/errata/RHSA-2026:2256) Network Observability (NETOBSERV) 1.11.0 `network-observability/network-observability-console-plugin-compat-rhel9:1771227610` [RHSA-2026:2900](https://access.redhat.com/errata/RHSA-2026:2900) Red Hat Advanced Cluster Security 4.8 `advanced-cluster-security/rhacs-main-rhel8:1769615659` [RHSA-2026:1517](https://access.redhat.com/errata/RHSA-2026:1517) Red Hat Advanced Cluster Security 4.9 `advanced-cluster-security/rhacs-main-rhel8:1770250889` [RHSA-2026:2350](https://access.redhat.com/errata/RHSA-2026:2350) Red Hat Advanced Cluster Security 4.9 `advanced-cluster-security/rhacs-main-rhel8:1770074713` [RHSA-2026:2568](https://access.redhat.com/errata/RHSA-2026:2568) Red Hat Ceph Storage 8 `rhceph/grafana-rhel9:1770630607` [RHSA-2026:2737](https://access.redhat.com/errata/RHSA-2026:2737) ## Frequently Asked Questions \### Summary CVE-2025-12816 has been reserved by CERT/CC \*\*Description\*\* An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions. ### Details A critical ASN.1 validation bypass vulnerability exists in the node-forge asn1.validate function within \`forge/lib/asn1.js\`. ASN.1 is a schema language that defines data structures, like the typed record sc O3 Security · Impact-Aware SCA ### Is CVE-2025-12816 in your dependencies? Find it across npm, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)