CVE-2025-12816
published 2025-11-25CVE-2025-12816: An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to…
PriorityP356high8.6CVSS 3.1
AVNACLPRNUINSCCNIHAN
EPSS
0.70%
49.3th percentile
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-node-forge | — | — |
| digital_bazaar | forge | <= 1.3.1 | — |
| digital_bazaar | node-forge | <= 1.3.1 | — |
| digital_bazaar | node-forge | >= 0 < 1.3.2 | 1.3.2 |
| digitalbazaar | forge | <= 1.3.1 | — |
| msrc | azl3_python-tensorboard_2.16.2-6_on_azure_linux_3.0 | — | — |
| msrc | cbl2_reaper_3.1.1-19_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
ghsa8.6HIGH
osv8.6HIGH
vendor_debian8.6HIGH
vendor_msrc8.6HIGH
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIDIS Prime
cisa_ics·2026-03-12·CVSS 7.5
[HIGH] Siemens SIDIS Prime
ICS Advisory
##
Siemens SIDIS Prime
Release DateMarch 12, 2026
Alert CodeICSA-26-071-03
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
The following versions of Siemens SIDIS Prime are affected:
- SIDIS Prime vers:intdot/<4.0.800 (CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-41996, CVE-2025-6965, CVE-2025-7783, CVE-2025-9230, CVE-2025-9232, CVE-2025-9670, CVE-2025-12816, CVE-2025-15284, CVE-2025-58751, CVE-2025-58752, CVE-2025-58754, CVE-202
Red Hat
node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications
vendor_redhat·2025-11-25·CVSS 8.6
CVE-2025-12816 [HIGH] CWE-179 node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications
node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
A flaw was found in node-forge. This vulnerability allows unauthenticated attackers to bypass downstream cryptographic verifications and security decisions via crafting ASN.1 (Abstract Syntax Notation One) structures to desynchronize schema validations, yielding a semantic divergence.
Statement: This vulnerability is rated Important for Red Hat products due to an interpretation conflict i
Microsoft
CVE-2025-12816: CVE-2025-12816
Mariner: Mariner
certcc: certcc
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn
vendor_msrc·2025-11-11·CVSS 8.6
CVE-2025-12816 [HIGH] CWE-436 CVE-2025-12816: CVE-2025-12816
Mariner: Mariner
certcc: certcc
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn
CVE-2025-12816
Mariner: Mariner
certcc: certcc
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2025-12816: node-node-forge - An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 ...
vendor_debian·2025·CVSS 8.6
CVE-2025-12816 [HIGH] CVE-2025-12816: node-node-forge - An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 ...
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
Scope: local
bullseye: open
GHSA
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
ghsa·2026-03-26
CVE-2026-33896 [HIGH] CWE-295 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
## Summary
`pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.
## Technical Details
In `lib/x509.js`, the `verifyCertificateChain()` function (around lines 3147-3199) has two conditional checks for CA authorization:
1. The `keyUsage` check (which includes a sub-check requiring `basicConstraints` to be present) is gated on `keyUsageExt !== null`
2. The `basicConstraints.cA` check is gated on `bcExt !== null`
When a certifica
OSV
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
osv·2026-03-26
CVE-2026-33896 [HIGH] Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
## Summary
`pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.
## Technical Details
In `lib/x509.js`, the `verifyCertificateChain()` function (around lines 3147-3199) has two conditional checks for CA authorization:
1. The `keyUsage` check (which includes a sub-check requiring `basicConstraints` to be present) is gated on `keyUsageExt !== null`
2. The `basicConstraints.cA` check is gated on `bcExt !== null`
When a certifica
GHSA
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
ghsa·2025-11-26·CVSS 8.6
CVE-2025-12816 [HIGH] CWE-436 node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
### Summary
CVE-2025-12816 has been reserved by CERT/CC
**Description**
An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
### Details
A critical ASN.1 validation bypass vulnerability exists in the node-forge asn1.validate function within `forge/lib/asn1.js`. ASN.1 is a schema language that defines data structures, like the typed record schemas used in X.509, PKCS#7, PKCS#12, etc. DER (Distinguished Encoding Rules), a strict binary encodi
OSV
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
osv·2025-11-26·CVSS 8.6
CVE-2025-12816 [HIGH] node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
### Summary
CVE-2025-12816 has been reserved by CERT/CC
**Description**
An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
### Details
A critical ASN.1 validation bypass vulnerability exists in the node-forge asn1.validate function within `forge/lib/asn1.js`. ASN.1 is a schema language that defines data structures, like the typed record schemas used in X.509, PKCS#7, PKCS#12, etc. DER (Distinguished Encoding Rules), a strict binary encodi
OSV
CVE-2025-12816: An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1
osv·2025-11-25·CVSS 8.6
CVE-2025-12816 [HIGH] CVE-2025-12816: An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Popular Forge library gets fix for signature verification bypass flaw
blogs_bleepingcomputer·2025-11-26·CVSS 8.6
CVE-2025-12816 [HIGH] Popular Forge library gets fix for signature verification bypass flaw
## Popular Forge library gets fix for signature verification bypass flaw
## Bill Toulas
A vulnerability in the ‘node-forge’ package, a popular JavaScript cryptography library, could be exploited to bypass signature verifications by crafting data that appears valid.
The flaw is tracked as CVE-2025-12816 and received a high severity rating. It arises from the library’s ASN.1 validation mechanism, which allows malformed data to pass checks even when it is cryptographically invalid.
“An interpretation-conflict vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions,” reads the flaw's desc
Bugzilla
CVE-2025-12816 h3: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [fedora-42]
bugzilla·2025-12-11·CVSS 8.6
CVE-2025-12816 [HIGH] CVE-2025-12816 h3: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [fedora-42]
CVE-2025-12816 h3: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
I
Bugzilla
CVE-2025-12816 grafana: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [fedora-42]
bugzilla·2025-12-11·CVSS 8.6
CVE-2025-12816 [HIGH] CVE-2025-12816 grafana: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [fedora-42]
CVE-2025-12816 grafana: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-
Bugzilla
CVE-2025-12816 node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications
bugzilla·2025-11-25·CVSS 8.6
CVE-2025-12816 [HIGH] CVE-2025-12816 node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications
CVE-2025-12816 node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
2025-11-25
Published