CVE-2025-12816

Опубликовано: 25 нояб. 2025

Источник: nvd

CVSS3: 8.6

EPSS Низкий

Описание

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Ссылки

https://github.com/digitalbazaar/forge
Product
https://github.com/digitalbazaar/forge/pull/1124
Issue Tracking
Patch
https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq
Exploit
Vendor Advisory
https://kb.cert.org/vuls/id/521113
Third Party Advisory
https://www.npmjs.com/package/node-forge
Product
https://www.kb.cert.org/vuls/id/521113
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:*

Версия до 1.3.1 (включая)

EPSS

Процентиль: 52%

0.00753

Низкий

8.6 High

CVSS3

Дефекты

CWE-436

Связанные уязвимости

CVE-2025-12816

CVSS3: 8.6

ubuntu

9 месяцев назад

CVE-2025-12816

CVSS3: 8.7

redhat

9 месяцев назад

CVE-2025-12816

CVSS3: 8.6

msrc

9 месяцев назад

CVE-2025-12816

CVSS3: 8.6

debian

9 месяцев назад

An interpretation-conflict (CWE-436) vulnerability in node-forge versi ...

GHSA-5gfm-wpxj-wjgq

CVSS3: 8.6

github

9 месяцев назад

node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

EPSS

Процентиль: 52%

0.00753

Низкий

8.6 High

CVSS3

Дефекты

CWE-436