CVE-2025-12816highCWE-436

CVE-2025-12816: falha de alta gravidade em Digital Bazaar node-forge

CVE-2025-12816

Publicada em 25 nov 2025

Seguir esta CVE + Monitorar forge + Monitorar node-forge

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.6%

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Produtos afetados

Digital Bazaar · forge Digital Bazaar · node-forge

Referências

https://github.com/digitalbazaar/forge https://github.com/digitalbazaar/forge/pull/1124 https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq https://kb.cert.org/vuls/id/521113 https://www.kb.cert.org/vuls/id/521113 https://www.npmjs.com/package/node-forge