Skip to main content

Forge CVE-2025-12816

HIGH
Interpretation Conflict (CWE-436)
2025-11-25 cret@cert.org
Authentication Bypass Forge Digitalbazaar
8.6
CVSS 3.1 · Vendor: cert
View

Vulnerability Assessment

Weakness
CWE
CWE-436
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
Impact

CVSS score of 8.6 (HIGH). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. Public proof-of-concept exploit code is available. EPSS exploitation probability: 0.08%.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected Packages

npm node-forge fix: 1.3.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-436. An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions. Affected products include: Digitalbazaar Forge.

Know when Forge gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (cert) PRIMARY 8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
SUSE HIGH
Red Hat 8.7 HIGH

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

3
Patch released
Mar 28, 2026 - 19:23 nvd
Patch available
PoC Detected
Jan 02, 2026 - 19:02 vuln.today
Public exploit code
CVE Published
Nov 25, 2025 - 20:15 nvd
HIGH 8.6

DescriptionCVE.org

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 966 npm packages depend on node-forge (16 direct, 950 indirect)

Ecosystem-wide dependent count for version 1.3.2.

Executive ViewAI

Why It Matters

Organizations using node-forge face significant risk from CVE-2025-12816 rated CVSS 8.6. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.1%
Top 77% exploitable
Exploit
POC
Public exploit code exists
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

63
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +43
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:*

More in Forge

View all
CVE-2020-7720 HIGH POC
7.3 Sep 01

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Rated high seve
CVE-2026-85393 HIGH
8.7 Sep 03

RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to craft signat
CVE-2025-66031 HIGH
8.7 Nov 26

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severi
CVE-2026-118779 HIGH
7.5 Oct 29

Regular expression denial of service in node-forge's pem.decode() allows remote, unauthenticated attackers to block the

CVE-2026-119191 HIGH
7.5 Oct 29

Denial of service in node-forge (Forge) 1.3.2 through 1.4.0 lets remote, unauthenticated attackers exhaust CPU time and

CVE-2026-119188 HIGH
7.5 Oct 29

Denial of service in node-forge's JavaScript TLS implementation: a connection created with forge.tls.createConnection()

CVE-2026-119187 HIGH
7.5 Oct 29

Call stack exhaustion in node-forge's TLS record processing (all versions through 1.4.0) allows a remote peer to crash o
CVE-2026-118782 HIGH
7.5 Oct 29

PKCS#12 MAC forgery and constant-key password-based decryption in node-forge 1.4.0 and earlier let anyone who does not k
CVE-2022-24772 HIGH
7.5 Mar 18

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severi
CVE-2022-24771 HIGH
7.5 Mar 18

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated high severi
CVE-2026-119190 HIGH
7.4 Oct 29

Certificate chain validation in node-forge (Forge) through version 1.4.0 can be bypassed because the parser maps the dep
CVE-2025-66030 MEDIUM
6.3 Nov 26

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Rated medium seve

Same weakness CWE-436 – Interpretation Conflict

View all
CVE-2026-63030 CRITICAL POC
9.8
CVE-2024-24754 CRITICAL POC
9.8
CVE-2023-24813 CRITICAL POC
9.8
CVE-2019-19589 CRITICAL POC
9.8
CVE-2026-67201 HIGH POC
7.7
CVE-2026-75931 HIGH POC
7.5
CVE-2026-13676 HIGH POC
7.5
CVE-2026-14643 HIGH POC
7.5

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-httpd:4.3.17.9.76.1 Affected
Container suse/manager/5.0/x86_64/server:latest Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.6 Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected

References

Advisories & patches
PATCH https://github.com/digitalbazaar/forge/pull/1124 ADVISORY https://access.redhat.com/errata/RHSA-2025:22936 ADVISORY https://access.redhat.com/errata/RHSA-2025:22937 ADVISORY https://access.redhat.com/errata/RHSA-2025:22938 ADVISORY https://access.redhat.com/errata/RHSA-2025:22941 ADVISORY https://access.redhat.com/errata/RHSA-2026:0261 ADVISORY https://access.redhat.com/errata/RHSA-2026:0414 ADVISORY https://access.redhat.com/errata/RHSA-2026:0518 ADVISORY https://access.redhat.com/errata/RHSA-2026:1248 ADVISORY https://access.redhat.com/errata/RHSA-2026:1517 ADVISORY https://access.redhat.com/errata/RHSA-2026:1730 ADVISORY https://access.redhat.com/errata/RHSA-2026:1942 ADVISORY https://access.redhat.com/errata/RHSA-2026:2106 ADVISORY https://access.redhat.com/errata/RHSA-2026:2256 ADVISORY https://access.redhat.com/errata/RHSA-2026:2350 ADVISORY https://access.redhat.com/errata/RHSA-2026:2456 ADVISORY https://access.redhat.com/errata/RHSA-2026:2500 ADVISORY https://access.redhat.com/errata/RHSA-2026:2568 ADVISORY https://access.redhat.com/errata/RHSA-2026:2695 ADVISORY https://access.redhat.com/errata/RHSA-2026:2737 ADVISORY https://access.redhat.com/errata/RHSA-2026:2754 ADVISORY https://access.redhat.com/errata/RHSA-2026:2762 ADVISORY https://access.redhat.com/errata/RHSA-2026:2900 ADVISORY https://access.redhat.com/errata/RHSA-2026:3710 ADVISORY https://access.redhat.com/errata/RHSA-2026:3712 ADVISORY https://access.redhat.com/errata/RHSA-2026:3713 ADVISORY https://access.redhat.com/errata/RHSA-2026:3825 ADVISORY https://access.redhat.com/errata/RHSA-2026:3869 ADVISORY https://access.redhat.com/errata/RHSA-2026:3874 ADVISORY https://access.redhat.com/errata/RHSA-2026:4185 ADVISORY https://access.redhat.com/errata/RHSA-2026:4215 ADVISORY https://access.redhat.com/errata/RHSA-2026:5807 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0628/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0630/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1008/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1013/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1035/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20232/ REF https://github.com/digitalbazaar/forge REF https://kb.cert.org/vuls/id/521113 REF https://www.kb.cert.org/vuls/id/521113 REF https://www.npmjs.com/package/node-forge

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy