{"action":"Upgrade node-forge to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"}],"component":"node-forge","cve_ids":["CVE-2025-12816"],"ecosystem":"npm","epss":0.00742,"exploited":false,"fixed_versions":["1.3.2"],"ghsa_id":"GHSA-5gfm-wpxj-wjgq","id":"tcs_01M5KF3P2PM8YZREY3DAAEMWSP","modified_at":"2026-09-10T03:50:30.566175753Z","published_at":"2025-11-26T22:07:19Z","references":["https://osv.dev/vulnerability/GHSA-5gfm-wpxj-wjgq","https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq","https://github.com/digitalbazaar/forge/pull/1124","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153","https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81","https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363","https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328","https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90","https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167","https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667","https://kb.cert.org/vuls/id/521113","https://www.kb.cert.org/vuls/id/521113","https://www.npmjs.com/package/node-forge"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-5gfm-wpxj-wjgq","url":"https://osv.dev/vulnerability/GHSA-5gfm-wpxj-wjgq"}],"summary":"node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization"}