← Back

CVE-2025-12816

nvd nist
Published: Nov 25, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.6
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 4.0
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Affected (1)

Products: Digitalbazaar: Forge
Digitalbazaar
1 product
Forge
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Forge
Up to 1.3.1

Related CWEs

CWE-436
Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References (6)

Source: cret@cert.org
Product
Source: cret@cert.org
Issue TrackingPatch
Source: cret@cert.org
ExploitVendor Advisory
Source: cret@cert.org
Third Party Advisory
Source: cret@cert.org
Product
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.