CVE-2025-12816

npm/node-forge CVE-2025-12816: high 8.6

node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

Action: Upgrade node-forge to 1.3.2 or later.

npm i node-forge@1.3.2

Affected

Fixed versions

Sources

• osv: GHSA-5gfm-wpxj-wjgq
• https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq
• https://github.com/digitalbazaar/forge/pull/1124
• https://github.com/digitalbazaar/forge
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667
• https://kb.cert.org/vuls/id/521113
• https://www.kb.cert.org/vuls/id/521113
• https://www.npmjs.com/package/node-forge

CVE-2025-12816 · published 2025-11-26T22:07:19Z · modified 2026-09-10T03:50:30.566175753Z · JSON